Methods and articles of manufacture for hosting a safety critical application on an uncontrolled data processing device

ABSTRACT

Methods and articles of manufacture for hosting a safety critical application on an uncontrolled data processing device are provided. Various combinations of installation, functional, host integrity, coexistence, interoperability, power management, and environment checks are performed at various times to determine if the safety critical application operates properly on the device. The operation of the SCA on the UDPD may be controlled accordingly.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.14/739,976, filed on Jun. 15, 2015, which application is a continuationof U.S. patent application Ser. No. 14/088,844, filed on Nov. 25, 2013,now U.S. Pat. No. 9,058,431, which application is a continuation of U.S.patent application Ser. No. 12/876,840, filed on Sep. 7, 2010, now U.S.Pat. No. 8,601,465, which applications claim priority to U.S.provisional patent application No. 61/359,265, filed Jun. 28, 2010,entitled “METHODS AND ARTICLES OF MANUFACTURE FOR HOSTING A SAFETYCRITICAL APPLICATION ON AN UNCONTROLLED DATA PROCESSING DEVICE”, and61/240,578, filed Sep. 8, 2009, entitled “MEDICAL AND MODIFIABLEPORTABLE CONSUMER ELECTRONIC DEVICE AND SYSTEM FOR MEDICAL DATAREPORTING AND ANALYSIS”, which are hereby incorporated by reference.

BACKGROUND

Safety critical systems are systems whose failures or malfunctions mayresult in significantly detrimental consequences such as death or injuryto persons, severe damage or loss to equipment or to environment.Because safety critical systems have potentially dangerous consequences,the entire system undergoes a verification and validation processes toprovide a certain level of confidence that the entire system operatesproperly and will continue to operate properly for all approved-for-useconditions.

Medical systems are an example of safety critical systems that require acertain level of confidence that the system will operate and continue tooperate properly. Medical systems may detrimentally affect a user'shealth and well-being if not operating properly or not known to beoperating properly. This is especially true for medical systems thatprovide user's with health-related diagnostic or therapeuticinformation. For example, analyte monitoring devices, such as glucosemeters, provide users with diagnostic information about theirblood-sugar levels. Inaccuracies or significant delays in reporting suchdiagnostic information may potentially lead to injury or death of auser. Furthermore, as another example, medical systems may provide userswith therapeutic information such as recommended medication dosages. Forinstance, glucose meters may provide users with recommended insulindosages in response to a glucose measurement in order to remedy thecurrent or anticipated blood sugar levels. Inaccuracies or significantdelays in reporting such therapeutic information may potentially lead toinjury or death of the user.

Once the entire safety critical system have been verified and validated,the entire system is released and is not expected to undergo softwareand/or hardware changes. This provides for a very controlled systemenvironment. New software and/or hardware changes are not introducedinto the market unless and until the new hardware and/or software haveundergone a new validation process. Such a controlled system environmentprovides a certain level of confidence that the system will not bealtered or changed and potentially affects the proper operation of thesystem.

However, when a safety critical application (SCA) is installed on anuncontrolled data processing device (UDPD) that permits hardware and/orsoftware changes by the user, any changes to the UDPD may detrimentallyaffect the proper operation of the SCA on the UDPD. UDPDs generallypermit the user to make software and/or hardware changes to thedevice—e.g., installing/removing software programs, installing/removingdrivers, adding/removing hardware components, etc. Example UDPDs mayinclude, personal computers (e.g., desktop, notebook, etc.), mobilephones (e.g., iPhones®, Blackberry®, etc.), personal digital assistants(PDAs), etc. Thus, the uncontrolled nature of the data processingdevices compromises any assurance that the SCA will operate, or continueto operate, properly on the UDPD.

SUMMARY

Methods and articles of manufacture for hosting safety criticalapplications on uncontrolled data processing devices are provided.Various combinations of checks (e.g., installation check, functionalcheck, host integrity check, coexistence check, interoperability check,power management check, environment check, etc.) are executed at varioustimes to determine if the SCA may operate properly on the device. Theoperation of the SCA on the UDPD may be controlled accordingly.

These and other objects, advantages, and features of the invention willbecome apparent to those persons skilled in the art upon reading thedetails of the invention as more fully described below.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is best understood from the following detailed descriptionwhen read in conjunction with the accompanying drawings. It isemphasized that, according to common practice, the various features ofthe drawings are not to-scale. On the contrary, the dimensions of thevarious features are arbitrarily expanded or reduced for clarity.Included in the drawings are the following figures:

FIG. 1 illustrates a flow diagram for a method of verification andvalidation for safety critical systems, according to the prior art;

FIG. 2 illustrates a high level block diagram of an example uncontrolleddata processing system, according to the prior art;

FIG. 3 illustrates a flow diagram for a method of verification andvalidation, according to some aspects of the present disclosure;

FIG. 4 illustrates a functional block diagram of SCA and test harnessstored in memory of a UDPD, according some aspects of the presentdisclosure;

FIG. 5 illustrates a block diagram of a functional check comprising oneor more test routines, according to some aspects of the presentdisclosure;

FIG. 6 illustrates a block diagram of a communication test routinecomprising one or more subroutines, according to some aspects of thepresent disclosure;

FIG. 7 illustrates a block diagram of a UDPD communicating with variousexternal devices via communication links, according to some aspects ofthe present disclosure;

FIG. 8 illustrates a flow diagram for installation check, according tosome aspects of the present disclosure;

FIG. 9 illustrates a flow diagram for a functional check, according tosome aspects of the present disclosure;

FIG. 10 illustrates a flow diagram for a functional check, according tosome aspects of the present disclosure;

FIG. 11 illustrates a flow diagram for an installation process,according to some aspects of the present disclosure;

FIG. 12 illustrates a flow diagram for a process for performing checks,according to some aspects of the present disclosure;

FIG. 13 illustrates a flow diagram for a host integrity check, accordingto some aspects of the present disclosure;

FIG. 14 illustrates a flow diagram for a coexistence check, according tosome aspects of the present disclosure;

FIG. 15 illustrates a flow diagram for an interoperability check,according to some aspects of the present disclosure; and

FIG. 16 illustrates a flow diagram for a power management check,according to some aspects of the present disclosure.

FIGS. 17A and 17B illustrate an adapter, including an analyte monitoringdevice, removably coupled to, and in communication with, a UDPD runninga SCA, according to some aspects of the present disclosure.

FIGS. 18A and 18B illustrate an adapter, including an analyte monitoringdevice, removably coupled to, and in communication with, a UDPD runninga SCA, according to some aspects of the present disclosure.

DETAILED DESCRIPTION OF THE INVENTION

Before the present inventions are described, it is to be understood thatthis invention is not limited to particular aspects described, as suchmay, of course, vary. It is also to be understood that the terminologyused herein is for the purpose of describing particular aspects only,and is not intended to be limiting, since the scope of the presentinvention will be limited only by the appended claims.

Where a range of values is provided, it is understood that eachintervening value, to the tenth of the unit of the lower limit unlessthe context clearly dictates otherwise, between the upper and lowerlimits of that range is also specifically disclosed. Each smaller rangebetween any stated value or intervening value in a stated range and anyother stated or intervening value in that stated range is encompassedwithin the invention. The upper and lower limits of these smaller rangesmay independently be included or excluded in the range, and each rangewhere either, neither or both limits are included in the smaller rangesis also encompassed within the invention, subject to any specificallyexcluded limit in the stated range. Where the stated range includes oneor both of the limits, ranges excluding either or both of those includedlimits are also included in the invention.

Unless defined otherwise, all technical and scientific terms used hereinhave the same meaning as commonly understood by one of ordinary skill inthe art to which this invention belongs. Although any methods andmaterials similar or equivalent to those described herein can be used inthe practice or testing of the present invention, some potential andpreferred methods and materials are now described. All publicationsmentioned herein are incorporated herein by reference to disclose anddescribe the methods and/or materials in connection with which thepublications are cited. It is understood that the present disclosuresupersedes any disclosure of an incorporated publication to the extentthere is a contradiction.

It must be noted that as used herein and in the appended claims, thesingular forms “a”, “an”, and “the” include plural referents unless thecontext clearly dictates otherwise. Thus, for example, reference to “afirmware update” includes a plurality of such firmware updates andreference to “the firmware update” includes reference to one or morefirmware updates and equivalents thereof known to those skilled in theart, and so forth.

The publications discussed herein are provided solely for theirdisclosure prior to the filing date of the present application. Nothingherein is to be construed as an admission that the present invention isnot entitled to antedate such publication by virtue of prior invention.Further, the dates of publication provided may be different from theactual publication dates which may need to be independently confirmed.

FIG. 1 illustrates a flow diagram for a method of verification andvalidation for safety critical systems, according to the prior art. Asshown, safety critical system 102 is a dedicated system comprising asafety critical application 104, commercial off-the-shelf softwarecomponents 106 (e.g., operating systems, drivers, etc.), and varioushardware components 108. Verification and validation process 100 isperformed on the entire dedicated system 102. After the initialverification and validation is complete, the entire dedicated system 102is provided to the user. The user is able to use the safety criticalsystem 102 for its intended purpose but cannot make system changes, suchas making changes to the operating system, modifying the applicationprogram, installing or removing drivers, installing or removing softwareprograms, making any significant hardware changes, etc. This controlledenvironment provides the manufacturer and user with a certain level ofconfidence that the entire dedicated safety critical system 102 not onlyoperates properly, but will not be subsequently altered or changed suchthat it does not operate properly in the future.

More and more people today, however, have access to one or more UDPDs.UDPDs have become an integral part of many people's lives and providepeople with continual and convenient access to various applications tobe used on these devices. For example, many people today have a desktopor laptop computer, as well as mobile phone, that they can downloadvarious applications to and use on the specific device. The moreaccessible the devices are to the user, the more convenient they become.While SCAs may be verified and validated before distribution to users,when loaded onto a UDPD, any assurance that the SCA will operateproperly is compromised because of the uncontrolled nature of the UDPD.

FIG. 2 illustrates a high level block diagram of an example uncontrolleddata processing system, according to the prior art. As shown in FIG. 2,UDPD 200 includes a system bus 202 which is coupled to processor 203,volatile memory 205, and non-volatile memory 206. The term processor isused herein to generally refer to any processing element such as amicroprocessor, microcontroller, digital signal processor, etc. Volatilememory 205 may include random access memory (RAM), for example, and/orany other type of memory that requires power continually in order torefresh or maintain the data in the memory. Non-volatile memory 206 mayinclude, for example, read-only memory (ROM), flash memory, electronicor magnetic or optical drives, and/or any other type of memory whichmaintains data even after power is removed from the system. While only asingle block is shown for each, it should be understood that one or moreprocessors, volatile memory, or non-volatile memory may be implemented.Moreover, memory 220 is represented by dotted lines and refers generallyto any available memory or other machine-readable media that can beaccessed by processor 202. As such, memory 220 is shown generally tocomprise volatile memory 205 and non-volatile memory 206.

Memory 220 is coupled to processor 203 via system bus 202 and storesinstruction sets to be executed by processor 203. Processor 203, in turncomprises processing elements and/or logic circuitry to execute theinstructions sets. System bus 202 interconnects these various componentstogether and also interconnects components 203, 205, and 206, to adisplay controller and display device 208, and to peripheral devicessuch as input/output (I/O) devices 210, such as numeric keypads,keyboards, modems, network interfaces, printers, scanners, video camerasand other devices which are well known in the art. In some instances,the I/O devices 210 are coupled to the system bus 202 throughinput/output controllers 209. System bus 202 may include one or morebuses connected to each other through various bridges, controllersand/or adapters (not shown) as is well known in the art. In someinstances, the I/O controller 209 includes a USB (Universal Serial Bus)adapter for controlling USB peripherals, and/or an IEEE-1394 bus adapterfor controlling IEEE-1394 peripherals.

While FIG. 2 shows that non-volatile memory 206 is a local devicecoupled directly to the rest of the components in the UDPD, it will beappreciated that in some instances the non-volatile memory may be remotefrom the system, such as a network storage device coupled to UDPD 200through a wired and/or wireless network via a network interface, orother suitable remote storage device. Furthermore, it will beappreciated that the various embodiments described herein may beimplemented with UDPDs which have more or fewer components than UDPD200.

UDPDs such as the one described above may have stored therein, anoperating system and other software programs (e.g., in Flash memory,hard drive, etc.). The programs may be initially provided in a varietyof ways to the UDPD—e.g., in manufacturing, through a remote connection(e.g., via a network interface to a remote location over a network), bya removable storage device (e.g., memory card, CD-ROM, etc.), etc. Theprograms and applications described herein comprise a set ofinstructions that are executed by the processor.

Programs are provided to the UDPD and are generally stored innon-volatile memory such as (Flash memory, hard drive, etc.). In someinstances, when the programs are to be run on the UDPD, the programs areloaded into volatile memory (e.g., RAM) and accessed by the processor tobe executed.

In some aspects, the UDPD may include a processor which implements anapplication programming interface (API) for running instruction sets orsoftware program. The API may include the ability for an instruction setto interrupt other instruction sets, and to control the presentation ofdata from another device (e.g., a medical device such as an analytemonitoring device and/or drug administration device) on various outputs(e.g., audio, visual, and tactile outputs) on the UDPD.

When a SCA is installed on a UDPD, there are no assurances that the SCAwill operate properly on the UDPD because there has been no verificationor validation process performed after the SCA is installed on the UDPD.The environment of the UDPD is dynamic and can change in a way thateffects the proper operation of the SCA on the UDPD. For example,various software programs and drivers may be installed and removed fromthe UDPD and not only change the processing environment of the UDPD, butalso may consume processing bandwidth making the UDPD process otherapplications more slowly. Various software configurations may be changedas well, which may affect the processing environment of the UDPD.Furthermore, changes to hardware components (e.g., wirelesscards/modems, etc.), or configurations thereof, may affect the properoperation of the SCA on the UDPD (e.g., prevent communication to anexternal device). Still further, activities of the user may lead to thesystem obtaining viruses or spyware that can change the environment ofthe UDPD or consume processing bandwidth and prevent the SCA fromoperating properly. Moreover, changes to the system may impact powerconsumption of the system which may compromise the SCA. Thus, theuncontrolled nature of the data processing devices compromises anyassurance that the SCA will operate or continue to operate properly onthe UDPD.

In some aspects of the present disclosure, methods and article ofmanufactures for hosting a safety critical application on anuncontrolled data processing device are provided. Various combinationsof checks (e.g., installation check, functional check, host integritycheck, coexistence check, interoperability check, power managementcheck, environment check, etc.) may be executed at various times todetermine if the SCA may operate properly on the device, and theoperation of the SCA on the UDPD may be controlled accordingly.

In some aspects of the present disclosure, a test harness module (alsoreferred to herein as “test harness”) is provided that comprises one ormore checks used to determine whether the SCA operates properly on theUDPD and to control the operation of the SCA on the UDPD accordingly.Example checks that the test harness may include, but not limited to,are an installation check, functional check, host integrity check,coexistence check, interoperability check, power management check,environment check. The methods and functions related to each aredescribed in further detail throughout the present disclosure.

FIG. 3 illustrates a flow diagram for a method of verification andvalidation, according to some aspects of the present disclosure. Asshown, verification and validation process 300 begins with an initialverification and validation performed on a SCA 304 and test harness 310to ensure that both successfully pass verification and validation, asrepresented by reference circle number one in FIG. 3. The initialverification and validation is performed by the manufacturer of SCA 304and test harness 310, for example, before SCA 304 and test harness 310are distributed to users.

In some instances, SCA 304 and test harness 310 may be verified andvalidated together at the same time, as shown. In some instances, SCA304 and test harness 310 may be separately verified and validated, andfurther may be verified and validated at different times (e.g., when anew version of either is implemented, etc.). It should be appreciatedthat while the test harness is described herein as a single testharness, it is contemplated that one or more of the checks may beprovided by one or more test harnesses on the same or different computerreadable media. Further, each test harness may be verified and validatedat different times in some instances.

It should also be appreciated that SCA 304 described herein may beassociated with a wide range of safety critical applications. In someaspects of the present disclosure, SCA 304 is a medically-relatedapplication. For example, SCA 304 may provide a user with health-relatedtools/features (e.g., information, computations, communications, etc.)associated with diagnosis, therapy and treatment, drug administrationand dosage, data management (e.g., logs, records, history, graphs,charts, reports, etc.), etc.

In some aspects of the present disclosure, SCA 304 is an applicationassociated with analyte monitoring and/or determination. Examplefeatures of SCA 304 may include, for example, one or more of thefollowing: determining analyte amounts or concentrations from a sample(e.g., saliva, blood, other bodily fluid, etc.); receiving measurementdata; managing and/or processing measurement data (e.g., loggingmeasurements, providing warnings based on measurement values, providingalternative representations of data in the form of reports, graphs,charts, etc.); calculating drug dosage amounts (e.g., insulin boluscalculations) based on measurement data, exercise data, food intake,etc.; communicating with a remote device external to UDPD 200 (e.g.,communicating drug dosage and/or administration data to a medicationdelivery device such as an insulin pump; receiving measurement data froma continuous in vivo monitoring device such as an implanted sensor;communicating with an analyte meter; etc.); other analyte monitoringfeature described herein; etc. It should be appreciated that the abovefeatures listed are exemplary and that other features associated withanalyte monitoring and/or determining may be implemented. In someaspects of the present disclosure, SCA 304 may be associated withglucose monitoring and/or determination. In some aspects of the presentdisclosure, SCA 304 may be associated with ketone monitoring and/ordetermination. Additional example applications related to analytemonitoring are provided in international patent application no.PCT/US2010/23076, entitled, “Multi-Function Analyte Test Device andMethods Therefor”, the entirety of which is incorporated herein byreference for all purposes.

After the initial verification and validation, SCA 304 and test harness310 are installed on a UDPD 200, as represented by reference circlenumber two. For example, the user may download SCA 304 and test harness310 via the internet, removable storage device (e.g., FLASH memory card,CD-ROM, etc.), or any other suitable machine-readable media, connection,or method. In some aspects of the present disclosure, an article ofmanufacture is provided that comprises machine-readable medium that hasvarious checks stored thereon as machine-executable instructions. Forinstance, the machine readable medium may have test harness storedtherein and in some instances SCA as well.

As mentioned before, example UDPDs may include, personal computers(e.g., desktop, notebook, etc.), mobile phones (e.g., iPhones®,Blackberry®, etc.), personal digital assistants (PDAs), digital musicplayer (e.g., iPod®), etc. Additional information and details for someexample uncontrolled data processing devices (e.g, iPhone®) aredescribed in US Patent Application Publication No. US2008/0122796published May 29, 2008 titled “Touch Screen Device, Method, andGraphical User Interface for Determining Commands by ApplyingHeuristics”, the entirety of which is incorporated herein by referencefor all purposes. In some aspects of the present disclosure a UDPD isprovided that includes a processor and memory operably coupled to theprocessor, wherein the memory has instructions stored therein to hostthe SCA on the UDPD. The memory may include instructions for one or moreof the various checks described herein. For instance, the memory mayhave test harness stored therein to perform the various checks on theSCA.

In some aspects of the present disclosure, an analyte monitoring systemis provided that includes a UDPD having a processor and memory operablycoupled to the processor, wherein the memory has instructions storedtherein to host the SCA on the UDPD. The memory may include instructionsfor one or more of the various checks described herein. For instances,the memory may have test harness stored therein to perform the variouschecks on the SCA.

In some aspects of the present disclosure, the analyte monitoring systemmay include, in addition to the UDPD, an element having a sensor forproviding measurement data from an analyte sample. The element is incommunication with the UDPD and provides the measurement data to theUDPD. It should be appreciated that the element may communicate with theUDPD via a wireless or wired connection using any variety of wired orwireless technology. In some instances, the element may be an implantedor on-body analyte sensor. In some instances, the element may include astrip port for receiving an analyte sample—e.g., via a test strip orother in-vitro application. In some instances, the element may be anadapter that removably couples to the UDPD.

SCA 304 and test harness 310 may be installed on UDPDs communicatingwith elements (e.g., adapters) and/or modules that provide additionalfunctionality to a UDPD running a SCA. Examples and additionalinformation of adapters used with UDPDs are described in U.S.provisional application No. 61/325,021 titled “Mobile Phone Display forContinuous Analyte Monitoring”, the entirety of which is incorporatedherein by reference for all purposes. Also, examples of analytemonitoring modules used with UDPDs are described in U.S. Pat. No.7,041,468 issued on May 9, 2006 titled “Blood Glucose Tracking Apparatusand Method” and in US Patent Application Publication No. US2004/0245534published Dec. 16, 2004 titled “Glucose Measuring Module and InsulinPump Combination”, the entireties of which are incorporated herein byreference for all purposes.

SCA 304 and test harness 310 may also be installed on a modular analytemonitoring devices when one or more modules are unprotected. Modularanalyte monitoring devices includes a base module and at least one othermodule that removably couples to the base module to form a singleintegrated analyte monitoring device. In this way, various modules withdifferent features may be coupled to the base module and provide thebase module with those corresponding features. If, for example, the basemodule is a UDPD that allows the user to download and/or remove softwareprograms, test harness 310 may be installed on the base module toprovide some level of assurance that the SCA installed on the basemodule may operate properly on the base module. Examples and additionalinformation on modular meters are described in U.S. provisional patentapplication No. 61/325,155, titled, “Modular Analyte Monitoring Device”,the entirety of which is incorporated herein by reference for allpurposes.

FIGS. 17A-B and 18A-B illustrate example UDPDs that couple with adaptersto acquire additional analyte monitoring capabilities and which may haveSCA 304 and test harness 310 installed thereon, according to someaspects of the present disclosure. FIGS. 17A and 17B illustrate anadapter including an analyte monitoring device, removably coupled to andin communication with a UDPD running a SCA. FIG. 17A illustrates apartially exploded perspective view, as well as a side view, of adapter1701 removably coupled to a UDPD 200. FIG. 17B illustrates a perspectiveview of adapter 1701 removably coupled to UDPD 200.

Adapter 1701 is shown comprising two pieces 1702 and 1703 that engage toform the adapter and permit the adapter 1701 to be securely coupled to,and removed from, UDPD 200. UDPD 200 is shown in this exemplary exampleas a mobile phone. It should be understood that UDPD 200 may be anyvariety of uncontrolled data processing devices—e.g., a PDA, mobilephone (e.g., cellular phone), etc. Such devices include for example,BlackBerry®, iPhone®, iPod®, iPod Touch® devices, etc.

Adapter 1701 is configured to communicate with UDPD 200. In someinstances, adapter 1701 may include a wireless communication module andcommunicate with UDPD 200 via wireless communication—e.g., viaBluetooth, infrared, or other wireless technology. In some instances,adapter 1701 may include a communication connector that communicateswith UDPD 200 via a wired connection—e.g., via a micro-USB port, orother communication connection, on UDPD 200.

Adapter 1701 includes strip port 1704 and associated circuitry forreceiving a sample for an analyte measurement. UDPD 200 has SCA 304stored within memory for execution by UDPD 200. SCA 304 is an analytemonitoring application which provides UDPD 200 with analyte monitoringcapabilities. Depending on the specific application implemented, one ormore analytes such as glucose, ketone, etc., may be monitored.

SCA 304 and UDPD 200 is in communication with adapter 1701 and uses thetest strip port 1704 to receive a test strip 1705 and perform ameasurement on the sample provided. For example, as shown in FIG. 17B,test strip 1705 is inserted into strip port 1704 provided by adapter1701. SCA 304 processes data from the test strip 1705 and obtains ameasurement reading using the processor of UDPD 200. SCA 304 thenconveys the measurement reading to the user via a display 1730 on UDPD200. It should be appreciated that additional monitoring capabilitiesmay also be performed by SCA 304 running on UDPD 200, such as thosedescribed herein—e.g., audibly outputting the measurement reading,logging the measurement data, providing alarms, calculating medicationdosages, communicating with medication delivery devices, etc.

UDPD 200 also has test harness 310 (and any other additional checksimplemented that are not necessarily part of test harness) stored inmemory and as described herein executes various checks to achieve acertain level of confidence that the SCA 304 may operate properly onUDPD 200. Also, as described herein, the various checks may be initiatedin various combinations and at different times as desired.

In some embodiments, adapter 1701 may be configured to perform theanalyte measurement (e.g., via an on-board processor) and communicatesthe measurement reading to UDPD 200 via the wired or wireless connectionwith UDPD 200. UDPD 200 runs SCA 304 and communicates with adapter 1701to receive the measurement readings and provides additional monitoringcapabilities such as those described herein—e.g., displaying and/oroutputting audibly the measurement reading, logging the measurementdata, providing alarms, calculating medication dosages, communicatingwith medication delivery devices, etc.

FIGS. 18A and 18B illustrate an adapter including an analyte monitoringdevice, removably coupled to and in communication with a UDPD running aSCA. FIG. 18A illustrates a partially exploded perspective view, as wellas a side view, of adapter 1801 removably coupled to UDPD 200. FIG. 18Billustrates a perspective view of adapter 1801 removably coupled to UDPD200. Adapter 1801 enables UDPD 200 to communicate with a remote device.

Adapter 1801 is shown comprising two pieces 1802 and 1803 that engage toform the adapter and permit the adapter 1801 to be securely coupled to,and removed from, UDPD 200. UDPD 200 is shown in this exemplaryembodiment as a mobile phone. It should be understood that UDPD 200 maybe any variety of uncontrolled data processing devices—e.g., a PDA,mobile phone (e.g., cellular phone), etc. Such devices include forexample, BlackBerry®, iPhone®, iPod®, iTouch® devices, etc.

Adapter 1801 is configured to communicate with UDPD 200. In someinstances, adapter 1801 may include a wireless communication module andcommunicate with UDPD 200 via wireless communication—e.g., viaBluetooth, infrared, or other wireless technology. In some instances,adapter 1801 may include a communication connector that communicateswith UDPD 200 via a wired connection—e.g., via a micro-USB port, orother communication connection, on UDPD 200. Adapter 1801 alsocommunicates with remote sensor device 1820 via a wireless communicationmodule, as shown in FIG. 18B. Remote sensor device 1820 is shown as anon-body analyte sensor (e.g., an implanted or partially implantedanalyte sensor) on user 1825. Remote sensor device 1820 may be, forexample, an implanted or partially implanted glucose sensor forcontinuous glucose measurement (CGM) or glucose on demand (God)applications.

UDPD 200 has SCA 304 stored within memory for execution by UDPD 200. SCA304 is an analyte monitoring application which provides UDPD 200 withanalyte monitoring capabilities. Depending on the specific applicationimplemented, one or more analytes such as glucose, ketone, etc., may bemonitored. SCA 304 and UDPD 200 are in communication with adapter 1701and uses adapter 1801 to communicate with remote sensor device 1820.Remote sensor device 1820 obtains analyte measurement data taken fromuser 1825 and communicates the data to SCA 304 and UDPD 200 via adapter1801. SCA 304 receives the measurement data and provides additionalmonitoring capabilities such as those described herein—e.g., displayingand/or audibly outputting the measurement reading, logging themeasurement data, providing alarms, calculating medication dosages,communicating with drug administration devices, etc.

Turning back to FIG. 3, after installation on UDPD 200, test harness 310is executed to determine whether SCA 304 operates properly on UDPD 200,as represented by reference circle number three. In some instances, testharness 310 and SCA 304 are configured such that test harness 310 isinitiated before SCA 304 is freely operational.

The terms “freely operational” and “operating freely” are used herein torefer to the SCA operating such that the user is able to use the SCA asintended and free of any restrictions implemented by the test harness.It should be appreciated that one or more safety critical features ofthe SCA may be “intended” to be locked or disabled (e.g., by themanufacturer, physician, etc.) from the user, and the running of the SCAwith the intentionally locked features is considered to be operatingfreely.

However, if the test harness restricts the use of the SCA, then the SCAis said to be prevented from operating freely. For example, in someinstances, this may include disabling the SCA and preventing the SCAfrom being run on the UDPD. In some instances, this may include lockingor disabling of one or more safety critical features of the SCA. In someinstances, this may include permitting the SCA to run on the UDPD sothat the user may still use non-safety critical features of the SCA butunable to use all safety critical features of the SCA. One or morechecks on test harness 310 may be performed before SCA 304 is freelyoperational to provide a certain level of assurance that SCA 304 mayoperate properly on UDPD 200 before the user uses the safety criticalfeatures. Further, in some instances, one or more checks on test harness310 may be performed during and/or after SCA is freely operational toprovide a certain level of assurance that that SCA 304 continues tooperate properly on UDPD 200.

It should be appreciated that the term “permitting” is used broadlyherein and may include allowing, enabling, unlocking, etc., in someinstances. Further, it should be appreciated that the term “preventing”is used broadly herein and may include restricting, disabling, locking,etc., in some instances.

In some aspects of the present disclosure, test harness 310 comprisesone or more of the following checks: an installation check to determineif SCA 304 was installed properly on UDPD 200; a functional check todetermine if SCA 304 functions properly on UDPD 200; a host integritycheck to determine if the integrity of SCA 304 has been compromised; acoexistence check to determine if SCA 304 is incompatible with otherprograms on UDPD 200; an interoperability check to determine if SCA 304interoperates properly on UDPD 200 with related programs; a powermanagement check to determine if the power capabilities of UDPD 200 aresufficient to run SCA 304 safely with a certain level of assurance thatthe UDPD will not abruptly shutdown; and an environment check todetermine a current environment of UDPD 200 at various times (e.g., whenchecks are initiated) and/or determine if a change in environment hasoccurred since a previous determination of a current environment (e.g.,at a time associated with the last time the SCA was determined tooperate properly on the UDPD). Furthermore, test harness 310 may executeone or more of these checks at various times—e.g., before SCA 304 isrun, while SCA 304 is being run, at predetermined intervals, etc.—and indifferent combinations as desired.

In some aspects of the present disclosure, executing test harness 310results in one or more checks being executed to determine whether SCA304 is operating properly on UDPD 200 and control the operation of SCA304 on UDPD 200 accordingly. For example, SCA 304 and test harness 310may be configured such that SCA 304 is prevented from operating freelyon UDPD when determined that SCA 304 is not operating properly on UDPD200.

In some instances, test harness 310 may be run in the background of UDPD200. SCA 304 and/or other software programs may, in some instances, berun in the foreground while test harness is run in the background onUDPD 200. Furthermore, it should be appreciated that, in some instances,the running of the test harness in the background may be transparent tothe user.

In some instances, test harness 310 and SCA 304 are part of largerprogram module 302 (also referred to herein as “program 302”), asrepresented by dotted lines. For example, the entire program 302 isinitially verified and validated, and subsequently installed on UDPD200. Program 302 may be configured to initiate test harness 310 beforeallowing SCA 304 to operate freely. In this way, test harness 310 isinitiated, in order to determine if SCA 304 may operate properly (e.g.,installed and functioning properly) on UDPD 200, and thus control theoperation of SCA 304 on UDPD 200 accordingly (e.g., permit or preventSCA 304 from operating freely on UDPD 200).

In some instances, SCA 304 and test harness 310 are separate programswhich may be initially verified and validated separately, and furthermay be installed on UDPD 200 at the same or different times. In suchcases, SCA 304 is configured to execute test harness 310 at theappropriate times. For example, SCA 304 may include commands to initiatetest harness 310 prior to SCA 304 being able to operate freely. In someinstances, if SCA 304 is installed on UDPD 200 and test harness 310 isnot, then SCA 304 is configured to prevent SCA 304 from operatingfreely.

In some instances, test harness 310 may be included within SCA 304. Anew SCA 304 may be written to include a test harness 310, or an existingSCA 304 may be modified to include test harness 310. In such case, SCA304 may be configured to initiate the test harness at the appropriatetimes. For example, SCA 304 may include commands to execute test harness310 before SCA 304 is freely operational (e.g., before safety criticalfeatures are accessible to the user). In this way, a determination canbe made as to the proper operation of SCA 304 on UDPD 200 before theuser ever uses the safety critical features of SCA 304. Test harness 310may also be implemented within SCA 304 such that it may be called uponone or more times or at various times as desired. It should beappreciated that SCA 304 and test harness 310 are shown separate in somefigures herein for illustrative purposes, and that embodiments with testharness 310 included within SCA 304 are applicable as well.

FIG. 4 illustrates a functional block diagram of SCA and test harnessaccessible to UDPD 200, according some aspects of the presentdisclosure. It should also be appreciated that although test harness 310and SCA 304 have been shown in memory 220 of UDPD 200 in FIG. 4, eitheror both may be embodied as machine-executable instructions on amachine-readable medium which is not necessarily local to or part ofUDPD 200, but at some point accessed by UDPD 200 in any suitable manner.

UDPD 200 is shown in FIG. 4 to include, as previously described, asystem bus 202 which is coupled to processor 203, memory 220, displaycontroller and display device 208, and peripheral devices such as I/Odevices 210. Memory 220 is shown to include SCA 304 and test harness310. Again, SCA 304 and test harness 310 may be part of a larger program302. It should be appreciated that memory 220 refers generally to anyvolatile and/or non-volatile memory available to processor 203, and mayinclude one or more memory components. Furthermore, either SCA 304 ortest harness 310, or both, may be stored in one or more memorycomponents, and further may be stored together or separate from oneanother in removable or non-removable memory. It should also beappreciated that in some instances SCA 304 and test harness 310 may bestored in non-volatile memory and loaded into volatile memory such asRAM for execution by processor 203.

In some aspects of the present disclosure, test harness 310 may compriseone or more hardware and/or software modules for performing the checksand processes described herein. The checks and processes describedherein, may for example, be executed by processor 203 of UDPD 200. Itshould be understood that the operations described for the checks(including test routines and subroutines) and processes described hereinare accordingly performed by the host UDPD. As shown in the exemplaryembodiment of FIG. 4, test harness 310 includes modules for aninstallation check 412, functional check 414, environment check 416,host integrity check 418, coexistence check 420, interoperability check422, and power management check 422. These checks are initiated todetermine whether SCA 304 may operate properly on UDPD 200.

Test harness 300 may be configured to run one or more of checks atvarious times as desired to perform the functions associated with eachcheck: an installation check to determine if SCA 304 was installedproperly on UDPD 200; a functional check to determine if SCA 304functions properly on UDPD 200; a host integrity check to determine ifthe integrity of SCA 304 has been compromised; a coexistence check todetermine if SCA 304 is incompatible with other programs on UDPD 200; aninteroperability check to determine if SCA 304 interoperates properly onUDPD 200 with related programs; a power management check to determine ifthe power capabilities of UDPD 200 are sufficient to run SCA 304 safelywith a certain level of assurance that the UDPD will not abruptlyshutdown; and an environment check to determine a current environment ofUDPD 200 at various times (e.g., when checks are initiated) and/ordetermine if a change in environment has occurred since a previousdetermination of a current environment (e.g., at a time associated withthe last time the SCA was determined to operate properly on the UDPD).

A determination that SCA 304 operates properly on UDPD 200 may requirespecific outcomes for each check that is implemented. For example, insome instances, a determination that SCA is operating properly on UDPDrequires an installation check to indicate that SCA is installedproperly and also requires a functional check to indicate that SCA isfunctioning properly on UDPD 200. In some instances, a determinationthat SCA is operating properly on UDPD requires only functional check toindicate that SCA is functioning properly on UDPD 200 (e.g., if a properinstallation has already been determined). A determination that SCA 304is not operating properly on UDPD 200 may result, for example, fromeither a determination that SCA is not installed properly or adetermination that SCA is not functioning properly. It should beappreciated that additional checks (e.g. host integrity check,coexistence check, interoperability check, power management check,and/or other checks not necessarily discussed herein) may also beimplemented, with their specific outcomes also required for adetermination that SCA operates properly on UDPD.

The environment of the UDPD refers generally to various software and/orhardware components, or their configurations thereof, which are presenton UDPD. For example, the environment check may identify varioussoftware programs, applications, drivers, hardware components, etc.,that are currently on the UDPD, that have been installed and/or removedand/or modified, etc. In some embodiments, only the software environmentmay be taken into consideration. In some embodiments, the hardwareenvironment may also be taken into consideration.

In some instances, the environment check is implemented to check to seeif the environment of UDPD has changed, which may be a possibleindicator that SCA no longer operates properly on UDPD. In such cases,one or more additional checks (e.g., functional check, host integritycheck, coexistence check, interoperability check, power managementcheck, etc.) may be executed to confirm that SCA is operating properlyon UDPD in the new environment.

In some instances, as shown in FIG. 4, test harness also includesreference data 408. Reference data 408 includes data used by testharness 310 to determine whether SCA 304 is performing withinpredetermined parameters and requirements that are associated with acertain level of confidence that SCA 304 is operating properly on UDPD200. For example, reference data 408 may include various test data to beused in the checks (e.g., predetermined input data or requests) as wellas any data, results, timing values, etc., that are acceptable orexpected to result from various checks to indicate proper operation ofthe UDPD. It should be understood that some parameters and requirementsmay encompass ranges and/or include tolerances which allow for somelevel of deviation.

Installation Check—

In some aspects of the present disclosure, an installation check 412 maybe executed to determine whether SCA 304 is installed properly on UDPD200. Because an improperly installed SCA compromises any assurance thatthe SCA is going to operate properly on UDPD, a successful installationof SCA 304 may be required in order to determine that SCA 304 operatesproperly on the UDPD. Thus, in some instances, if SCA 304 failed toinstall properly on UDPD 200, then it may be determined that SCA 304does not operate properly on UDPD 200 and SCA 304 may be prevented fromoperating freely on UDPD 200. If installation check indicates that SCA304 installed properly on UDPD 200, however, SCA 304 may still notnecessarily operate properly on UDPD and additional checks may berequired before determining that the SCA operates properly on the UDPD.

In some instances, images of installed components of SCA 304 (alsoreferred to herein as “installed SCA components”) may be used todetermine whether SCA 304 is installed properly on UDPD 200. Forexample, an installation package for SCA 304 may include a plurality offiles that are loaded onto UDPD 200 in addition to a primary executablefile. Installation check 412 may view each of these files as aninstalled SCA component and compare images of each installed SCAcomponent against reference data 408 corresponding to data that isexpected for a proper installation (also referred to herein as“reference installation data” to distinguish it from other data that maybe within reference data 408). For instance, in some instances, an imageof an installed SCA component may include data about the installed SCAcomponent, such as filename, version number, error detection and/orerror correction data (e.g., cyclic redundancy check (CRC) value, errorcorrecting code (ECC), checksum, etc.), etc. Installation check 412compares the data for each installed SCA component against expected dataassociated with a proper installation (e.g., as defined by the referenceinstallation data) to determine whether a proper installation hasoccurred. For example, a filename, CRC value, and/or version numberassociated with the installed SCA component may be compared withcorresponding expected filename, CRC value, and/or version number in thereference installation data.

If, for example, the image of one or more installed SCA components doesnot match the reference installation data, then installation check 412indicates that SCA 304 failed to install properly on UDPD 200, whichindicates that SCA 304 does not operate properly on UDPD 200. SCA 304may then be prevented from operating freely on UDPD 200. In someinstances, a failure to install properly may be reported (e.g., loggedand/or communicated to the user of UDPD 200). In some instances, areport of the failure may be sent to a remote device—e.g., via theinternet.

If, for example, the image of each installed SCA component matches thereference installation data, then the installation check indicates thatSCA 304 installed properly on UDPD 200 and one or more other checks(e.g., functional check, host integrity check, coexistence check,interoperability check, power management check, etc.) may be executed ifrequired. The term “match” is used broadly herein to indicate fallingwithin predetermined parameters and requirements (e.g., as defined bythe reference data). A resulting match for the installation check thusrepresents a certain level of confidence that SCA 304 installed properlyon UDPD 200. In some instances, the predetermined parameters andrequirements require an “exact” match. However, it should be appreciatedthat, in some instances, parameters and requirements may encompassranges and/or tolerances which allow for some deviation from an “exactmatch” requirement. Accordingly, the term “non-match” is used broadlyherein to indicate not falling within the predetermined parameters andrequirements (e.g., as defined by reference data). A resulting non-matchfor the installation check thus represents a certain level of confidencethat SCA 304 did not install properly on UDPD 200.

Functional Check—

In some aspects of the present disclosure, a functional check 414 may beexecuted to determine whether SCA 304 functions properly on UDPD 200.For example, functional check 414 may check whether SCA 304 performscomputations (e.g., calculations, measurements, etc.) accurately on UDPD200; whether SCA 304 displays data properly on a display of UDPD 200;and/or whether SCA 304 communicates properly via UDPD with an externaldevice; and/or whether SCA 304 performs these and/or other safetycritical activities in a proper amount of time.

A delay in performing an activity may have detrimental consequences andmay indicate improper operating of SCA 304 on UDPD 200. For example, asignificant delay in providing a computation for a glucose measurementmay be sufficient to determine that SCA 304 is not operating properly onUDPD 200. Further, it should be appreciated that in some instances,performing an activity such as a computation too quickly may beindicative of improper functioning as well. Functional check 414 mayalso, for example, check whether data for SCA 304 is displayed properlyon a display of UDPD 200; and/or whether SCA 304 may communicateproperly between UDPD 200 and an external device.

If, for example, it is determined that SCA 304 does not functionproperly, then functional check 414 indicates that SCA 304 does notoperate properly on UDPD 200. SCA 304 may then be prevented fromoperating freely on UDPD 200. If, for example, it is determined that SCA304 functions properly, then other checks may also be initiated asrequired (or if no other checks are required to be executed, then SCAmay be permitted to operate freely).

Environment Check—

In some aspects of the present disclosure, an environment check 416 maybe executed to determine a current environment of UDPD 200. Further, insome instances, environment check 416 may be executed to determinewhether the current environment has changed since the last determinationthat SCA 304 is operating properly on UDPD 200. Changes to theenvironment of the UDPD may affect the proper operation of SCA 304 onUDPD 200. Thus, in some instances, the environment check may includeidentifying the current environment and comparing it to a previouslystored ‘current environment’ that was associated with the lastdetermination that SCA 304 is operating properly on UDPD 200.

For example, test harness 310 may initiate environment check 416 toobtain a current environment of UDPD 200 when it is determined that SCAis operating properly and permitted to operate freely on UDPD 200. Inthis way, test harness 310 may later initiate environment check 416 todetermine if the ‘current environment’ of UDPD 200 has changed sincethis determination that SCA is operating properly. It should beappreciated that the current environment may be identified and recordedat various times associated with the performing of the checks—e.g.,before the check is initiated, while the check is initiated, or afterthe check has provided an outcome.

If it is determined that the environment of UDPD 200 changes, then SCA304 may potentially operate improperly on UDPD 200. Test harness 310 maythen, for example, initiate a functional check (or any additional checksif implemented as well) to be executed. In some instances, SCA 304 maybe permitted to continue to operate freely while the functional check isbeing performed. In some instances, SCA 304 may be prevented fromoperating freely while the functional check is being performed.

If it is determined that environment of UDPD 200 does not change, then acertain level of confidence is achieved that SCA 304 is still operatingproperly on UDPD 200. SCA 304 may, for example, be permitted to continueoperating freely if the environment of UDPD 200 does not change. Itshould be appreciated that one or more checks may be initiated ifdesired, despite the determination that the environment has not changed.

Environment check may be initiated at various times as desired—e.g., atpredetermined times and/or time intervals (while SCA is running and/ornot running); upon occurrences of certain events (e.g., when SCA 304 isrun, when SCA 304 is closed, when the UDPD is powered, etc.). In someinstances, additional checks such as functional check 414 may beinitiated independent of the environment check 416 and may also beinitiated at various times (e.g., at predetermined times and/or uponoccurrences of certain events).

Host Integrity Check—

In some aspects of the present disclosure, a host integrity check may beexecuted to determine if the integrity of SCA 304 has been corrupted. Acorrupted SCA 304 compromises any assurance that SCA 304 operatesproperly on UDPD 200. In some instances when a host integrity check isimplemented, a determination that SCA 304 operates properly on UDPD 200requires at least a determination that SCA 304 is not corrupted. If SCA304 is corrupted, it may be determined that SCA 304 does not operateproperly on UDPD 200 and SCA 304 may be prevented from operating freelyon UDPD 200. If SCA 304 is determined to be uncorrupted, then it may bedetermined that SCA 304 operates properly and permitted to operatefreely, as long as any other required checks performed, or to beperformed, are successfully passed as well.

Coexistence Check—

UDPD 200 typically hosts additional programs loaded on the device inaddition to SCA 304. Furthermore, programs may typically be added toand/or deleted from UDPD 200 at different times. Some of the programs onUDPD 200 may not work together with SCA 304 but may share resources withSCA 304, referred to herein as “nonrelated” programs. SCA 304 and one ormore non-related programs may, for example, access one or morepersistent area of data. For instance, both may track data & time, readand/or write data to the same memory device, etc. Moreover, both SCA 304and the non-related program(s) may access the same components—e.g.,wireless chip, display, audio components, etc.

For some of the nonrelated programs, SCA 304 may not be affected, oraffected in ways that do not threaten the safety critical nature of SCA304, when coexisting on UDPD 200 with SCA 304. However, some programsmay not be able to coexist on UDPD 200 with SCA 304 without compromisinga safety critical aspect of SCA 304, or operation thereof, on UDPD 200.For example, a nonrelated program that is running may prevent orsignificantly delay SCA 304 from access to a safety critical functionsuch as displaying a test result, sounding an alarm, accessing wirelesscommunication, etc. If these functions are safety critical features, thecoexistence of the two programs on UDPD 200 may pose safety criticalissues that potentially prevent SCA 304 from operating properly on UDPD200 and SCA 304 may be prevented from operating freely.

In some instances, the SCA 304 may have priority access to resources incertain circumstances. For example if an expected time for receipt ofdata from another device (e.g., a medical device such as an analytemonitoring device, drug administration device, etc.) is exceeded by apredetermined amount of time, SCA 304 may be give priority access toinformation outputs for the UDPD 200 to activate an alarm, for example.As part of this priority access, an automatic save state may beinitiated, for example, for other modules operating on the UDPD 200.Additionally, SCA 304 may be give priority access to communication portson the UDPD 200—e.g., to communicate the alarm to a third party such asparent, friend, physician, etc. The SCA 304 may, for example, havepriority access to wireless communication devices, memory, processors,and/or any other shared resource that may be prioritized.

In some aspects of the present disclosure, a coexistence check may beexecuted to determine if SCA 304 is incompatible with non-relatedprograms on UDPD 200. The term “incompatible” is used broadly herein tomean that SCA 304 and other program(s) cannot coexist on UDPD 200without compromising the safety critical aspects of SCA 304, oroperation thereof, on UDPD 200.

In some instances, when a coexistence check is implemented, adetermination that SCA 304 operates properly on UDPD 200 requires atleast a determination that SCA 304 is not incompatible with anynon-related program. If SCA 304 is incompatible with one or morenonrelated programs, then SCA 304 may be prevented from operating freelyon UDPD 200. If SCA 304 is not incompatible with any nonrelatedprograms, then it may be determined that SCA 304 operates properly andthus permitted to operate freely on UDPD 200, as long as any otherrequired checks performed, or to be performed, are successfully passedas well.

Interoperability Check—

One or more programs may interoperate with SCA 304 to providefunctionality and capabilities to SCA 304, referred to herein as relatedprograms. In some aspects of the present disclosure, an interoperabilitycheck may be executed to determine if SCA 304 interoperates properly onUDPD 200 with related programs. Interoperability problems may compromiseany assurance that SCA 304 is going to operate properly on UDPD 200. Insome instances, a determination that SCA 304 operates properly on theUDPD requires at least a determination that SCA 304 interoperatesproperly with related programs. If SCA 304 does not interoperateproperly with related programs, then it may be determined that SCA 304does not operate properly and SCA 304 may be prevented from operatingfreely on UDPD 200. If SCA 304 is determined to interoperate properly,then it may be determined that SCA 304 operates properly on the UDPD andthus permitted to operate freely, as long as any other required checksperformed, or to be performed, are successfully passed as well.

Power Management Check—

Some UDPDs may be battery powered and not necessarily plugged into an ACpower outlet. Thus, the life of UDPD 200 is volatile in the sense thatUDPD 200 could run out of power and shut down during operation of SCA304. Battery power may be dependent upon a number of factors—e.g., typeand size of battery used, the type and amount of activity performed byUDPD 200, etc. Unexpected or early power loss could compromise thesafety critical nature of a SCA 304.

In some aspects of the present disclosure, a power management check maybe executed to determine if the power capabilities of UDPD 200 aresufficient to run SCA 304 safely with a certain level of assurance thatthe UDPD will not abruptly shutdown. For instances, the powercapabilities may be determined and compared to a minimum thresholdamount required to operate SCA 304 safely with minimal risk of an abruptshutdown. In some instances, a determination that SCA 304 operatesproperly requires at least that the UDPD have sufficient powercapabilities to operate safely with minimal risk of shutdown. If UDPD200 has sufficient power capability, then SCA 304 may be determined tooperate properly on UDPD 200 and permitted to operate freely on UDPD200, as long as any other required checks performed, or required to beperformed, are successfully passed as well. If UDPD 200 does not havesufficient power capability, then SCA 304 may be prevented fromoperating freely.

In some embodiments, a check may include one or more test routines to beinitiated. FIG. 5 illustrates a block diagram of a functional checkcomprising one or more test routines, according to some aspects of thepresent disclosure. As shown, functional check 414 includescomputational test routines 530, timing test routines 532, display testroutines 534, and communication test routines 536.

Computational test routines 530 determine whether SCA 304 is performingcomputations accurately on UDPD 200—e.g., within predeterminedparameters and requirements that represent a certain level of confidencethat SCA 304 is computing accurately on UDPD 200. The predeterminedparameters and requirements may be defined, for example, by referencedata 408 (also referred to herein as “reference computational data” todistinguish it from other data that may be within reference data 408).

Specific computations may vary depending on the specific safety criticalfeatures implemented within SCA 304. Computations may include, forexample, various calculations, measurements, extrapolations, etc., for awide variety of applications, such as medical applications and otherSCAs. For example, computations for analyte monitoring applications mayinclude, but are not limited to, computing analyte (e.g., glucose)measurements, calculating medicine dosages and/or administration times(e.g., insulin dosages from received glucose measurements), executingvarious other therapy-related algorithms (e.g., trending calculations,various alert determinations, etc.), and/or other safety criticalcomputations that are applicable to analyte monitoring.

In some instances, execution of computational test routines 530 mayinitiate specific computations to be performed by SCA 304 usingpredetermined input data (e.g., as defined by reference data 408,referred to herein as “reference computational input” to distinguish itfrom other data that may be within reference data 408). Accordingly,reference computational data include the expected or acceptable resultsfor these computations using the reference computational input. Theactual result of the computation and the reference computational datamay be compared to determine if the computations are performedaccurately on UDPD 200.

Reference computational input may simulate, for example, safety criticalinput data provided to SCA 304 and UDPD 200 while SCA 304 is operatingfreely. For example, when operating freely, SCA 304 and UDPD 200 may beconfigured to receive data from one or more external devices (e.g.,analyte measurements, such as glucose measurements, from externalanalyte monitoring devices, such as a glucose monitoring devices) andthen perform various computations on the received data. Computationaltest routines 530 initiate such computations by SCA 304 and UDPD 200using reference computational input which simulates such received data(e.g., analyte measurements from an external device). The results of thecomputations may then be compared against the corresponding referencecomputational data to determine if SCA 304 is computing accurately onUDPD 200.

If, for example, it is determined that SCA 304 does not perform thecomputations accurately (e.g., results of the computation do not matchthe reference computational data), then computation test routines 530indicates that SCA 304 is not functioning properly on UDPD 200, whichfurther indicates that SCA 304 is not operating properly on UDPD 200.SCA 304 may then be prevented from operating freely on UDPD 200.

In some instances, a determination that SCA 304 functions properly onUDPD 200 requires at least a determination that SCA 304 performscomputations accurately (e.g., a match between the result of thecomputation and the reference computational data). It should beappreciated that although a condition is required for SCA to functionproperly, that does not necessary mean that SCA functions properly ifthat condition is met—other conditions may also be required to be met.For example, in some instances, in order for SCA to function properly itmay be required that SCA 304 performs computations accurately (e.g.,results of the computation match the reference computational data), aswell as be required that SCA performs computations in a timely manner.Thus, the occurrence of one condition alone does not necessarily meanSCA functions properly. If, for example, it is determined that SCA 304performs computations accurately (e.g., results of the computation matchthe reference computational data), then other checks and/or testroutines may be initiated (or if no other checks and/or test routinesare required to be executed, then SCA may be permitted to operatefreely).

Timing test routines 532 determine whether SCA 304 performs activities(e.g., computations, communications, etc.) on UDPD 200 in a timelymanner—e.g., within times falling within predetermined parameters andrequirements that represent a certain level of confidence that SCA 304is performing the activities in a timely manner on UDPD 200. Thepredetermined parameters and requirements may be defined, for example,by reference data 408 (also referred to herein as “reference timingdata” to distinguish it from other data that may be within referencedata 408) Activities may include any variety of activities implementedby SCA 304—e.g., safety critical computations such as described above,displaying of various results on a display of UDPD 200, communicationsto external devices, executing of checks and test routines, anycombination thereof, etc.

For example, timing test routines 532 may determine the time it takesfor SCA 304 to perform computations initiated by computational testroutines 530. In some instances, for example, time stamps or logs ofparticular events or duration of events may be recorded. For example,various times associated with the execution of computational testroutines 530 may be logged or recorded—e.g., the time when referencecomputational input is provided to SCA 304, and the time whencorresponding results are provided by SCA 304 (the difference of the twotimes representing the time it took SCA 304 to perform the computationon UDPD 200). In some instances, the additional time it takes to displaythe information is taken into account. It should be appreciated that atimer may also be implemented or any other suitable method of trackingtime.

The timing results may then be compared against corresponding referencetiming data to determine whether SCA 304 is performing activities (e.g.,computations, communications, etc.) on UDPD 200 in a timely manner.Again, it should also be appreciated that, in some instances, theperformance of an activity in too short of a time period may beindicative of SCA 304 not performing in a timely manner on the UDPD.

If, for example, it is determined that SCA 304 does not performactivities in a timely manner (e.g., the time to perform the activitydoes not match the reference timing data) on UDPD 200, then timing testroutines 532 indicates that SCA 304 is not functioning properly on UDPD200, which further indicates that SCA 304 is not operating properly onUDPD 200. SCA 304 may then be prevented from operating freely on UDPD200.

In some instances, a determination that SCA 304 functions properly onUDPD 200 requires at least that SCA 304 perform activities in a timelymanner (e.g., a match between the time to perform activities and thereference timing data). For example, if it is determined that SCA 304performs activities in a timely manner (e.g., the time to perform theactivity matches the reference timing data) on UDPD 200, then otherchecks and/or test routines may be initiated (or if no other checksand/or test routines are required to be performed, then SCA may bepermitted to operate freely).

Display test routines 534 determine whether data for SCA 304 is properlydisplayed on UDPD 200—e.g., within predetermined parameters andrequirements that represent a certain level of confidence that SCA 304is displaying data properly on UDPD 200. The predetermined parametersand requirements may be defined, for example, by reference data 408(also referred to herein as “reference display data” to distinguish itfrom other data that may be within reference data 408). In someinstances, reference display data corresponds to an expected result of acomputational test routine that is to be displayed on the display ofUDPD 200.

Display test routines 534 may, for example, initiate specificpredetermined images defined by reference data 408 (referred to hereinas “reference display inputs” to distinguish it from other data that maybe within reference data 408) to be displayed on a display of UDPD 200.Accordingly, reference display data may include the expected outputimage corresponding to the reference display inputs. The actual imagedisplayed and the reference display data may then be compared todetermine if data is being displayed properly on UDPD 200 (e.g., todetermine if the actual image displayed matches the reference displaydata).

It should be understood that the term images is used broadly herein toinclude any form of data to be displayed on the display (e.g., pixelpatterns, image files (e.g., JPEG, TIFF, GIF, BMP, etc.), text,numerals, etc. In some instances, a display pattern may be used.Furthermore, in some instances, display patterns may also be used totest various display diagnostics, such as timing/scan rates, smear,brightness, contrast, etc.

The actual image displayed on UDPD 200 may be determined in any of avariety of ways. In some instances, a screen capture may be taken. Forexample, display test routines 534 may include a print screen functioncall to initiate a screen capture for the image displayed on the displayof UDPD 200). The actual image displayed on UDPD 200 may then becompared to the reference display data to determine if data is beingproperly displayed on UDPD 200. It should be appreciated that the printscreen function does not require the UDPD to be connected to a printer,but rather illustrates that the display test routines 534 may “read” thedisplay, which is normally a write only device.

It should also be appreciated that various comparison algorithms may beimplemented to compare the actual image displayed on UDPD 200 with thereference display data. For example, in some instances, comparisonalgorithm may convert the actual image displayed to a representativevalue or expression. In such case, for example, the reference displaydata may be an expected representative value or expression of thereference display inputs. Thus, the two values or expression may becompared to determine if a match or non-match occurs. In some instances,the comparison algorithm may compare the images themselves, in whichcase the reference display data would be equivalent to the referencedisplay inputs. It should be appreciated that any variety of methods ofcomparing may be implemented.

In some instances, the actual image displayed on UDPD 200 may bedetermined by receiving user input that identifies the actual imagedisplayed on the display of UDPD 200. The user may be prompted, forexample, to confirm the accuracy of the display (e.g., to enter thenumeral, text, symbol, or phrase that is displayed; or to provide anyother form of confirmation response to information displayed on thedisplay; etc.). In such instances, for example, user confirmation mayfunction as the actual image displayed, and thus compared to referencedisplay data that indicates what is expected to be displayed. In thisway, it may be determined whether images are displayed on the UDPDproperly.

For example, a request for user verification may be initiated todetermine whether data is accurately displayed on UDPD 200. Forinstance, a verification inquiry may be conveyed (visually, audibly,etc.) to the user, prompting the user to input what is displayed on thedisplay of the UDPD (e.g., an alphanumeric code, numeric code, symbols,text, phrases, etc.). The actual image displayed on the display may bedetermined by initiating an image (e.g., the code) to be displayed onthe display of UDPD 200 and receiving user input identifying what isdisplayed. The actual image displayed identified by the user input maythen be compared with reference display data to determine if the correctimage is displayed.

Furthermore, the level of assurance that the user input accuratelyidentifies the actual image displayed may vary based on the type ofverification inquiry implemented. For example, a basic level ofassurance can be achieved by having the user provide yes or no feedback.For example, the verification inquiry may ask if the user sees aspecific image (e.g., “Do you see a car on the display?”). It should beappreciate that the image may be any variety of pictures, symbols,words, phrases, numbers, etc. The user may then respond to the inquiryby inputting the appropriate answer on the UDPD (e.g., typing “yes” or“no”, touching the “yes” or “no” button on the touch screen, etc.). Theuser input identifying if the image is a car or not is received andcompared with reference display data (e.g., a response of “yes”indicating that the image is properly displayed on the display; aresponse of “no” indicating that the image is not properly displayed onthe display).

Another level of assurance can be achieved by using a verificationinquiry that has the user respond to a multiple choice question. Thegreater the number of answer choices available reduces the chance of theuser guessing and providing a false positive. For example, theverification inquiry may ask, “Do you see a car, tree, or the number 12on the display?” The user may then respond to the verification inquiryby selecting or entering the appropriate answer. The user inputidentifying the actual image displayed on the display is then comparedwith reference display data that identifies what was expected to bedisplayed on the display.

Another level of assurance can be achieved by using a verificationinquiry that has the user respond to an open question or command. Forexample, verification inquiry may ask, “What do you see?”; “Enter thetext, code, symbol, etc., that you see on the display; etc. The user maythen respond to the verification inquiry by entering the appropriateanswer (e.g., by typing in what they see; entering the code, symbol,etc., displayed; etc.). The user input identifying the actual imagedisplayed on the display is then compared with reference display datathat identifies what was expected to be displayed on the display.

If, for example, it is determined that UDPD 200 does not displayreference display inputs properly (e.g., the actual image displayed doesnot match the reference display data), then display test routines 534indicates that SCA 304 is not functioning properly on UDPD 200, whichfurther indicates that SCA 304 is not operating properly on UDPD 200.SCA 304 may then be prevented from operating freely on UDPD 200.

In some instances, a determination that SCA 304 functions properly onUDPD 200 requires at least that UDPD 200 displays reference displayinputs properly. For example, if it is determined that UDPD 200 doesdisplay reference display inputs properly (e.g., the actual imagedisplayed matches the reference display data), then other checks and/ortest routines may be executed as desired (or if no other checks and/ortest routines are required to be executed, then SCA may be permitted tooperate freely).

In some embodiments, SCA 304 and UDPD 200 may be configured tocommunicate with an external device via a communication link (e.g., awired or wireless communication link). Communication test routines 536may be initiated to determine whether SCA 304 communicates properly onUDPD 200 with the external device. For instance, communication testroutines 536 may determine whether SCA 304 may properly establish acommunication link between UDPD 200 and the external device, whether SCA304 may communicate (e.g., send and/or receive data) accurately, etc.The communications may also be required to be performed in a timelymanner over the communication link for SCA 304 to be communicatingproperly with an external device via a communication link with UDPD. Thecommunication test routines 536 may apply to unidirectional and/orbidirectional testing.

SCA 304 may communicate with external devices for various purposesdepending on the specific SCA implemented. Looking ahead to FIG. 7, FIG.7 illustrates a block diagram of a UDPD communicating with variousexternal devices via communication links, according to some aspects ofthe present disclosure.

As shown in FIG. 7, system 700 comprises UDPD 200 communicating with ananalyte monitoring device 705 via communication link 715; dataprocessing device 706 via communication link 716, and medicationdelivery device 707 via communication link 717. UDPD 200 includescommunication module 605 which forms communication links 715-717 withcommunication modules 730-732 of external devices 705-707, respectively.Communication module 605 and communication modules 730-732 may include,for example, appropriate transmitters, receivers, and/or transceivers.It should be appreciated that communication links 715-717 may beimplemented with wired (e.g., USB, Ethernet, or any other suitable wiredtechnology) or wireless technologies (e.g., Bluetooth, infrared, radiofrequency identification (RFID), or any other suitable wirelesstechnology). While communication module 605 is represented by one block,it should be appreciated that communication module 605 may comprise oneor more communication modules of one or more communication technologies.For example, communication module 605 may include a Bluetooth module tocommunicate with one external device over Bluetooth and another infraredmodule to communicate with another external device over infrared. Itshould also be appreciated that UDPD 200 may be configured tocommunicate with one or more of the devices shown, or with anotherexternal device not shown.

UDPD 200 further includes processor 203 which executes various sets ofinstructions for SCA 304 and test harness 310, and further controls theoperation of communication module 605. In some embodiments, UDPD 200 isa mobile phone, such as an iPhone® or Blackberry®, with SCA 304 and testharness 310 installed thereon. While a mobile phone is used to describethis particular embodiment, it should be appreciated that any UDPD mayapply.

Analyte monitoring device 705 may be, for example, a glucose monitoringdevice such as a glucose meter. In some instances, analyte monitoringdevice 705 may be a continuous glucose monitoring (CGM) device and/orglucose on demand (GoD) device. For example, a CGM device and/or GoDdevice may comprise an implanted sensor that allows glucose measurementdata to be taken from a patient and then transmitted to UDPD 200 via awireless communication, such as Bluetooth, for use by SCA 304.Additional information for implanted sensors may be found in U.S. patentapplication Ser. No 12/807,278 entitled “Compact On Body PhysiologicalMonitoring Devices And Methods Thereof ”(U.S. 2010/0198034 A1), which isassigned to the assignee of the present application, Abbott DiabetesCare Inc., and the entirety of which is incorporated herein by referencefor all purposes.

Medication delivery device 707 may be, for example, an insulin pump usedto deliver insulin dosages based on received dosage calculation from SCA304 on UDPD 200. UDPD 200 may receive glucose measurements from device709, for example, and calculate the recommended insulin dosages based onthe glucose measurements and then transmit the recommended dosages tomedication delivery device 707.

Data processing device 706 may be, for example, any type of computerdevice, such as personal computers (e.g., desktop, notebook, etc.),mobile phones (e.g., iPhone®, Blackberry®, etc.), personal digitalassistants (PDAs), etc. UDPD 200 may communicate with data processingdevice 706 for various purposes—e.g., transmitting and/or receiving testresults, logging data, using network capabilities of data processingdevice 706, etc.

If, for example, it is determined that SCA 304 does not communicateproperly on UDPD 200 with the external device, then communication testroutines 536 indicate that SCA 304 does not function properly on UDPD200, which further indicates that SCA 304 does not operate properly onUDPD 200. SCA 304 may then be prevented from operating freely on UDPD200.

In some instances, a determination that SCA 304 functions properly onUDPD 200 requires that SCA 304 communicates properly on UDPD 200 withthe external device. For example, if it is determined that SCA 304communicates properly on UDPD 200 with the external device, then otherchecks and/or test routines may be initiated as required (or if no otherchecks are required to be executed, then SCA may be permitted to operatefreely).

In some embodiments, test routines may include one or more subroutinesto be initiated. The terms “subroutines” and “test routines” are usedherein to simply distinguish hierarchy between the two in order tofacilitate understanding of the concepts presented herein. FIG. 6illustrates a block diagram of a communication test routine comprisingone or more subroutines, according to some aspects of the presentdisclosure. As shown, communication test routines 536 includecommunication setup subroutines 638 and communication verificationsubroutines 640.

Setup subroutines 638 are initiated to determine whether SCA 304 mayproperly establish a communication link between UDPD 200 and an externaldevice. Execution of setup subroutines 538 may initiate SCA 304 toestablish a communication link between UDPD 200 and an external device.For example, SCA 304 may attempt to establish a communication linkbetween UDPD 200 and an analyte monitoring device and/or medicationdelivery device. For example, the SCA on the UDPD may communicate withan insulin pump to provide dosage data, for example. It should beappreciated that any variety of methods may be implemented to determineif the communication link is established properly—e.g., using ahandshake process, by detecting a beacon signal from the externaldevice, etc.).

If, for example, it is determined that SCA 304 may not properlyestablish a communication link between UDPD 200 and an external device,then communication setup subroutines 638 indicates that SCA 304 does notcommunicate properly between UDPD 200 and the external device, whichindicates that SCA 304 does not function properly on UDPD 200, whichfurther indicates that SCA 304 does not operate properly on UDPD 200.SCA 304 may then be prevented from operating freely on UDPD 200.

In some instances, a determination that SCA 304 communicates properly onUDPD 200 requires a determination that SCA 304 may properly establish acommunication link between UDPD 200 and the external device. Forexample, if it is determined that SCA 304 may properly establish acommunication link between UDPD 200 and an external device, then otherchecks and/or test routines and/or subroutines may be initiated asrequired (or if no other checks and/or test routines and/or subroutinesare required to be executed, then SCA may be permitted to operatefreely).

Verification subroutines 640 are executed to determine whether SCA 304communicates (e.g., send and/or receive data) accurately over thecommunication link between UDPD 200 and the external device—e.g., withinpredetermined parameters and requirements that represent a certain levelof confidence that SCA 304 is communicating accurately between UDPD 200and the external device. The predetermined parameters and requirementsmay be defined by reference data 408 (also referred to herein as“reference communication data” to distinguish it from other data thatmay be within reference data 408).

In some instances, execution of verification subroutines 640 mayinitiate specific communications to be performed between UDPD 200 andthe external device using reference data provided by the verificationsubroutines (referred to herein as “reference communication inputs” todistinguish it from other data that may be within reference data 408).Reference communication inputs may be any variety of data—e.g., a testsignal, a request for data, etc. In some instances, execution ofverification subroutines 640 may initiate SCA 304 to send out data tothe external device to be “echoed” back. The echoed data received maythen be compared to the data sent out to determine if the data was sentand returned without any data compromised or corrupted. For example, ifSCA 304 is a glucose monitoring application that is designed to wirelesscommunicate with an insulin pump, execution of the verificationssubroutines 640 may initiate data to be sent to the insulin pump to beechoed back. The received echoed data may then be compared to the datatransmitted. As another example, in some instances, execution ofverification subroutines 640 may initiate SCA 304 to request data fromthe external device. For example, if SCA 304 is a glucose monitoringapplication that is designed to communicate via Bluetooth with acontinuous glucose monitoring device, then execution of the verificationsubroutines 640 may initiate SCA 304 to request data from the continuousglucose monitoring device over the Bluetooth link.

Accordingly, reference communication data may include expected oracceptable results for the communications initiated using the referencecommunication inputs (e.g., test signal, request for data, etc.). Thereference communication data may include, for example, the expected testsignal (e.g., expected “echoed” signal), expected confirmation signalsin response to transmitted test signals; expected data in response torequests for data; expected values; expected type of data (e.g., text,numerals, picture/movie file, etc.); expected communication protocolused, any combination thereof, etc.

The actual results of the communications (e.g., the test signalreceived, the response to the test signal, the confirmation signalreceived, the data received in response to a request for data, theexpected value, the type of data received, the communication protocolused, any combination thereof, etc.) is compared with the referencecommunication data to determine if they match or do not match.Verification subroutines 640 may then determine whether SCA 304communicates accurately over the communication link between UDPD 200 andthe external device.

If, for example, it is determined that SCA 304 does not communicateaccurately over the communication link between UDPD 200 and the externaldevice, then verification subroutines 640 indicates that SCA 304 doesnot communicate properly between UDPD 200 and the external device, whichindicates that SCA 304 does not function properly on UDPD 200, whichfurther indicates that SCA 304 does not operate properly on UDPD 200.SCA 304 may then be prevented from operating freely on UDPD 200.

In some instances, a determination that SCA 304 communicates properly onUDPD 200 requires a determination that SCA 304 communicates accuratelyover the communication link between UDPD 200 and the external device.For example, if it is determined that SCA 304 does communicateaccurately over the communication link between UDPD 200 and the externaldevice, then other checks and/or test routines and/or subroutines may beinitiated as required (or if no other checks and/or test routines and/orsubroutines are required to be executed, then SCA may be permitted tooperate freely).

Timing test routines 532 may be executed to determine whether SCA 304performs communications on UDPD 200 with an external device in a timelymanner—e.g., within times falling within “reference timing data” thatrepresent a certain level of confidence that SCA 304 is communicating ina timely manner on UDPD 200 with an external device.

For example, timing test routines 532 may determine the time it takesfor SCA 304 to properly establish a communication link between UDPD 200and an external device initiated by setup subroutines 638, and/or toperform communications initiated by verification subroutines 640. Again,various times associated with the communication test routines 536 may belogged or recorded to determine whether SCA 304 is performingcommunications in a timely manner. In some instances, timing informationmay be included with the reference communication inputs (e.g., with thetest signal, data request, etc.) sent to the external device, and/ortiming information provided in the data sent by the external device. Inthis way, the timing of each one way communication may be determined.Furthermore, it should be appreciated that communication test routinesmay include a timing subroutine that fulfills the same functions as thetiming test routines 532 with respect to communication times.

If, for example, it is determined that SCA 304 does not perform thecommunication (and/or does not establish a communication link) in atimely manner (e.g., the time does not match the reference timing data)on UDPD 200, then timing test routines 532 indicates that SCA 304 doesnot communicate properly on UDPD 200, which indicates that SCA 304 doesnot function properly on UDPD 200, which further indicates that SCA 304is not operating properly on UDPD 200. SCA 304 may then be preventedfrom operating freely on UDPD 200.

In some instances, a determination that SCA 304 communicates properly onUDPD 200 requires that SCA 304 performs the communication and/orestablishes a communication link in a timely manner (e.g., the timesmatch the reference timing data). For example, if it is determined thatSCA 304 performs the communication and/or establishes a communicationlink in a timely manner on UDPD 200, then other checks and/or testroutines may be initiated if required (or if no other checks and/or testroutines are required to be executed, then SCA may be permitted tooperate freely).

In some aspects of the present disclosure, a loopback hardware modulemay be implemented to perform various loopback tests on the UDPD. Theloopback testing may determine, for example, if other components such ascommunication ports on the UDPD are operating properly. For instance,the loopback module may be a physical hardware device that couples to acommunication port on the UDPD and receives a test communication fromthe UDPD and returns the test signal. It should be appreciatedcommunication port is used broadly herein to encompass any type ofcommunication receptacle or plug using any type of communicationtechnology—e.g., any of the USB family, including Mini-USB andMicro-USB; Firewire; Ethernet; etc.

For example, test harness may comprise a test routine that may beexecuted to send a test signal to a communication port of the UDPD thathas the loopback module attached. The loopback module receives the testsignal and “echoes” it back via the same communication port. In someinstances, the loopback module may be coupled to more than onecommunication port and receives the test signal in a first communicationport and sends it back via one or more other ports. The loopback modulemay include, for example, switches to route the test signal accordingly.The echoed signal received may then be compared against the originaltest signal to determine if the communication hardware is operatingproperly on the UDPD. In some instances, the timing of the test signalmay also be tested to see if the test signal is transmitted and returnedin the expected time frame. It should be appreciated that, in someinstances, the test routine for such loopback testing may be implementedas part of the communication and/or timing test routine. It should alsobe appreciated that, in some instances, the loopback back module maycomprise hardware and/or software implemented within the UDPD.

FIG. 8 illustrates a flow diagram for an installation check, accordingto some aspects of the present disclosure. It should be understood thatdetails discussed above for installation checks may be applicable toFIG. 8. As shown in FIG. 8, at block 805 of installation check 800, animage of an installed SCA component (e.g., one of a plurality of filesfor SCA 304 installed on UDPD 200) is identified. The image of aninstalled SCA component may include, for example, data about theinstalled SCA component, such as filename, version number, a cyclicredundancy value (CRC), etc.

At block 810, the image of the installed SCA component is compared toreference installation data corresponding to data that is expected for aproper installation. For example, a filename, CRC value, and/or versionnumber associated with the installed SCA component may be compared withcorresponding expected filename, CRC value, and/or version number in thereference installation data.

Based on the results of the comparison, a determination is made as towhether the installed SCA component was installed properly or not, asrepresented by block 815. For example, a determination may be made as towhether the image of each installed SCA component matches or does notmatch the reference installation data.

If, for example, the image of the installed SCA component does not matchthe reference installation data, then it is determined that SCA 304failed to install properly on UDPD 200, as represented by block 820. SCA304 may then be prevented from operating freely on UDPD 200. Again, insome instances, this may comprise disabling the SCA so that it is unableto be run on the UDPD. In some instances, this may comprise permittingthe SCA to operate so that the user may still use non-safety criticalfeatures of the SCA but unable to use the safety critical features. Insome instances, the failure to install properly is reported (e.g.,logged and/or communicated to the user of the UDPD, etc.). In someinstances, a report of the failure may be sent to a remote device—e.g.,via the internet.

If, for example, the image of the installed SCA component matches thereference installation data, then it is determined that the installedSCA component installed properly on UDPD 200 and a determination is madeas to whether there are any additional images of installed SCAcomponents that require checking, as represented by block 830.

If there are additional images of installed SCA components that requirechecking, the next installed SCA component is identified and the processrepeated for the next installed SCA component, as represented by thearrow returning to block 810. This process is repeated until allinstalled SCA components that are required to be checked have beenidentified and determined if installed properly.

When no additional installed SCA components are remaining, and allinstalled SCA components are determined to be installed properly, theinstallation checks 412 indicates that SCA 304 was installed properly onUDPD 200, as represented by block 840. In some instances, the properinstallation of SCA 304 is reported (e.g., logged and/or communicated tothe user of UDPD 200, etc.). In some instances, a report of the properinstallation may be sent to a remote device—e.g., via the internet.

FIG. 9 illustrates a flow diagram for a functional check, according tosome aspects of the present disclosure. It should be understood thatdetails discussed above for functional check may also be applicable toFIG. 9. As shown in FIG. 9, at block 905 of functional check 900, one ormore computational test routines are run to determine whether SCA 304 isperforming computations accurately on UDPD 200. For example, referencecomputational input are provided to SCA 304 and specific safety criticalcomputations are initiated by SCA 304 on UDPD 200 using the referencecomputational input. The results of the computations are compared withreference computational data to determine if the results fall withinpredetermined parameters and requirements defined by referencecomputational data.

Again, specific computations may vary depending on the specific safetycritical features implemented within SCA 304. Computations may include,for example, various calculations, measurements, extrapolations, etc.,for a wide variety of applications, such as medical applications andother SCAs. For example, computations for analyte monitoringapplications may include, but are not limited to, computing analyte(e.g., glucose) measurements, calculating medicine dosages and/oradministration times (e.g., insulin dosages from received glucosemeasurements), executing various other therapy-related algorithms (e.g.,trending calculations, various alert determinations, etc.), and/or othersafety critical computations that are applicable to the specific SCAimplemented.

At block 910, a determination is made as to whether the results of thecomputations match or do not match the reference computational data. Ifthe results do not fall within the reference computational data, then itis determined that SCA 304 does not perform the computations accurately.This indicates that SCA 304 is not functioning properly on UDPD 200, andthus not operating properly on UDPD 200. SCA 304 may then be preventedfrom operating freely on UDPD 200, as represented by block 920. If theresults do fall within the reference computational data, then SCA 304performs the computations accurately on UDPD 200 and one or more timingtest routines are run, as represented by block 925.

At block 925, the times it takes to perform various activities (e.g.,computations of block 905) on UDPD 200 are determined and compared withreference timing data. For example, timing test routines 532 maydetermine the time it takes for SCA 304 to perform computationsinitiated by computational test routines 530. In some instances, forexample, time stamps or logs of particular events or duration of eventsmay be recorded. For example, various times associated with theexecution of computational test routines 530 may be logged orrecorded—e.g., the time when reference computational input is providedto SCA 304, and the time when corresponding results are provided by SCA304 (the difference of the two times representing the time it took SCA304 to perform the computation on UDPD 200). In some instances, newactivities are performed and the beginning and ending times are recordedsuch that the duration of the activity is determined. It should beappreciated that a timer may also be implemented or any other suitablemethod of tracking time.

At block 930 a determination is made as to whether the times to performthe activities (e.g., computations of block 905) fall within thereference timing data. If, for example, the times do not fall within thereference timing data, then SCA 304 does not perform the computations ina timely manner on UDPD 200, indicating that SCA 304 is not functioningproperly on UDPD 200, and thus not operating properly on UDPD 200. SCA304 may then be prevented from operating freely on UDPD 200, asrepresented by block 920. If, for example, the times to perform theactivities (e.g., computations of block 905) do fall within thereference timing data, then SCA 304 performs the computations in atimely manner on UDPD 200 and one or more display test routines may berun, as represented by block 935.

At block 935, specific predetermined images defined by reference displayinputs are initiated to be displayed on the display of UDPD 200. Theactual image displayed is identified, as represented by block 940. Forexample, a screen capture may be initiated to identify the actual imagedisplayed. Any form of data may be displayed on the display as desired(e.g., pixel patterns, image files (jpeg, etc.), text, numerals, etc.).In some instances, the reference display inputs corresponds to anexpected result of a computation performed at block 905 that is to bedisplayed on the display. In some instances, a display pattern may beused. The actual image displayed is then compared to reference displaydata to determine if the actual images displayed on UDPD 200 matches ordoes not match the reference display data, as represented by block 950.

At optional block 945, user verification or interaction is alsorequired. The user may be prompted, for example, to confirm that UDPDdisplays data properly. For example, the user may be prompted to enterthe numeral, text, or phrase that is displayed; or to provide any otherform of confirmation response to the image shown on the display; etc.Based on whether a valid user confirmation is received, it is determinedif the reference display inputs is properly displayed on UDPD 200.

At block 950, a determination is made as to whether the actual imagedisplayed on UDPD 200 is displayed properly (e.g., within thepredetermined parameters and requirements defined by the referencedisplay data). For example, the reference display data may include datarepresenting the expected or correct image of the screen capture. Theactual image displayed is compared to the reference display data todetermine whether the actual image displayed matches or does not matchthe reference display data. Furthermore, the reference display data mayinclude the expected or valid user confirmation that is to be receivedfor user confirmation that the UDPD displays data properly.

If, for example, the actual image displayed (e.g., determined eitherfrom the screenshot or from user confirmation) does not match thereference display data, then SCA 304 is not functioning properly on UDPD200, which indicates that SCA 304 is not operating properly on UDPD 200.The SCA is then prevented from operating freely on the UDPD, asrepresented by block 920. If, for example, the actual image displayed(and user confirmation) matches the reference display data, then SCA 304is functioning properly on UDPD 200, as represented by block 955.

FIG. 10 illustrates a flow diagram for a functional check, according tosome aspects of the present disclosure. The embodiment shown in FIG. 10is similar to the functional check described in FIG. 9 except that theembodiment shown in FIG. 10 includes communication test routines. Forthe sake of clarity and brevity, the duplicative description in FIG. 9has been condensed in great detail for FIG. 10, and it should beunderstood that the description above for similar blocks in FIG. 9 applyto FIG. 10 as well.

At block 1005 of functional check 1000, one or more computational testroutines are executed. Reference computational inputs are provided toSCA 304 and specific safety critical computations are initiated by SCA304 on UDPD 200 using the reference computational input. The results ofthe computations are compared with reference computational data todetermine if the results fall within predetermined parameters andrequirements defined by reference computational data.

At block 1010, a determination is made as to whether the results of thecomputations match or do not match the reference computational data. If,for example, the results do not fall within the reference computationaldata, then it is determined that SCA 304 does not perform thecomputations accurately, indicating that SCA 304 is not functioningproperly on UDPD 200, and thus not operating properly on UDPD 200. SCA304 may then be prevented from operating freely on UDPD 200, asrepresented by block 1020. If, for example, the results do fall withinthe reference computational data, then SCA 304 performs the computationsaccurately on UDPD 200 and one or more timing test routines are run, asrepresented by block 1025.

At block 1025, the times it takes to perform various activities (e.g.,computations of block 1005) on UDPD 200 are determined and compared withreference timing data. In some instances, the times to perform thecomputations of block 1005 are determined. For example, the beginningand ending times of the computations may have been recorded—e.g., whenthe reference computational input was provided, and when a result wasdetermined. In some instances, new activities are performed and thebeginning and ending times are recorded such that the duration of theactivity is determined.

At block 1030 a determination is made as to whether the times to performthe activities (e.g., computations of block 1005) fall within thereference timing data. If, for example, the times do not fall within thereference timing data, then SCA 304 does not perform the computations ina timely manner on UDPD 200, indicating that SCA 304 is not functioningproperly on UDPD 200, and thus not operating properly on UDPD 200. SCA304 may then be prevented from operating freely on UDPD 200, asrepresented by block 1020. If, for example, the times to perform theactivities (e.g., computations of block 1005) do fall within thereference timing data, then SCA 304 performs the computations in atimely manner on UDPD 200 and one or more communication test routinesmay be run, as represented by block 1031.

At block 1031, communication test routines are initiated to determinewhether SCA 304 communicates properly between UDPD 200 and an externaldevice. At block 1031, setup subroutines are initiated to determinewhether SCA 304 may properly establish a communication link between UDPD200 and an external device. Setup subroutines initiate SCA 304 toestablish a communication link between UDPD 200 and an external device.

At block 1032, a determination is made as to whether SCA 304 properlyestablished a communication link between UDPD 200 and an externaldevice. If, for example, it is determined that SCA 304 may not properlyestablish a communication link between UDPD 200 and an external device,then communication setup subroutines indicate that SCA 304 does notcommunicate properly between UDPD 200 and the external device, whichfurther indicates that SCA 304 does not function properly on UDPD 200,which further indicates that SCA 304 does not operate properly on UDPD200. SCA 304 may then be prevented from operating freely on UDPD 200, asrepresented by block 1020.

If, for example, it is determined that SCA 304 may properly establish acommunication link between UDPD 200 and an external device, thenverification subroutines are run, as represented by block 1033.Verification subroutines determine whether SCA 304 communicates (e.g.,send and/or receive data) accurately over the communication link betweenUDPD 200 and the external device—e.g., within predetermined parametersand requirements defined by reference communication data.

Specific SCA communications are initiated between UDPD 200 and theexternal device using reference communication inputs (e.g., test signal,echo signal, request for data, etc.). The actual results of thecommunications (e.g., echo signal received, response to a test signal,the confirmation signal received, the data received in response to arequest for data, the expected value, the type of data received, thecommunication protocol used, any combination thereof, etc.) is comparedwith the reference communication data. In some instances, the referencecommunication data may be the same as the reference communicationinputs—e.g., when an echo signal is implemented.

A determination is made as to whether the actual results of thecommunication match or do not match the reference communication data, asrepresented by block 1034. If, for example, it is determined that theactual results of the communication do not match the referencecommunication data, then SCA 304 does not communicate accurately overthe communication link between UDPD 200 and the external device, whichindicates that SCA 304 does not communicate properly between UDPD 200and the external device, which further indicates that SCA 304 does notfunction properly on UDPD 200, which further indicates that SCA 304 doesnot operate properly on UDPD 200. SCA 304 may then be prevented fromoperating freely on UDPD 200, as represented by block 1020.

At block 1033, optional timing test routines may also be run todetermine whether SCA 304 performs communications on UDPD 200 with anexternal device in a timely manner—e.g., within times falling within“reference timing data” that represent a certain level of confidencethat SCA 304 is communicating in a timely manner on UDPD 200 with anexternal device. For example, the time it takes for SCA 304 to properlyestablish a communication link between UDPD 200 and an external devicein block 1031 may be determined; and/or the time it takes to perform thecommunications initiated in block 1033 may be determined.

At block 1034 a determination is made as to whether SCA 304 performs thecommunication in a timely manner (e.g., whether the time it takes toperform the communications initiated in block 1033 matches the referencetiming data). If, for example, it is determined that SCA 304 does notperform the communication in a timely manner (e.g., the time does notmatch the reference timing data) on UDPD 200, then a determination ismade that the SCA 304 does not communicate properly on UDPD 200, whichindicates that SCA 304 does not function properly on UDPD 200, whichfurther indicates that SCA 304 is not operating properly on UDPD 200.SCA 304 may then be prevented from operating freely on UDPD 200, asrepresented by block 1020.

If, for example, it is determined that the actual results of thecommunication matches the reference communication data, then SCA 304communicates accurately over the communication link between UDPD 200 andthe external device. Further, if the time to perform the communicationmatches the reference timing data, then it is determined that SCA 304performs the communication in a timely manner on UDPD 200.

At block 1035, display test routines are run. Upon execution of displaytest routines, specific predetermined images defined by referencedisplay inputs are initiated to be displayed on the display of UDPD 200.The actual image displayed is identified, as represented by block 1040.For example, a screen capture may be initiated to identify the actualimage displayed. In some instances, the reference display inputscorresponds to an expected result of a computation performed at block1005 that is to be displayed on the display. The actual image displayedis then compared to reference display data to determine if the actualimages displayed on UDPD 200 matches or does not match the referencedisplay data, as represented by block 1050.

At optional block 1045, user verification or interaction is alsorequired. The user may be prompted, for example, to confirm that UDPDdisplays data properly. For example, the user may be prompted to enterthe numeral, text, or phrase that is displayed; or to provide any otherform of confirmation response to the image shown on the display; etc.Based on whether a valid user confirmation is received, it is determinedif the reference display inputs is properly displayed on UDPD 200. Insome instances, the display testing may involve the remote device. Forexample, the user could be asked to confirm the existence of, orreenter, displayed information on the remote display to confirm theoverall functionality. A code may be displayed on the display of theremote device, for example, and the user prompted to reenter the code onthe remote device.

At block 1050, a determination is made as to whether the actual imagedisplayed on UDPD 200 is within the predetermined parameters andrequirements defined by the reference display data. If, for example, theactual image displayed (and/or user confirmation) does not match thereference display data, then SCA 304 is not functioning properly on UDPD200, which indicates that SCA 304 is not operating properly on UDPD 200.The SCA is then prevented from operating freely on the UDPD, asrepresented by block 1020. If, for example, the actual image displayed(and user confirmation) matches the reference display data, then SCA 304is determined to be functioning properly on UDPD 200, as represented byblock 1055.

It should be appreciated that in some embodiments the above checks maybe executed at various times and in various combinations to achievedifferent levels of confidence that the SCA is operating properly on theUDPD. FIGS. 11 and 12 illustrate example flow diagrams for hosting a SCAon a UDPD, according to some aspects of the present disclosure. Thediscussion above for the various checks, test routines, and subroutinesare also applicable to FIGS. 11 and 12.

FIG. 11 illustrates a flow diagram for an installation process,according to some aspects of the present disclosure. At block 1105 ofprocess 1100, SCA 304 and test harness 310 are installed on UDPD 200. Insome instances, SCA 304 may be initially prevented from freely operatingon UDPD 200 to ensure that the following initial checks are firstperformed before the user uses SCA 304.

At block 1110, an installation check is initiated. For example, in some,the installation test identifies and compares images of installed SCAcomponents with reference installation data. It should be appreciatedthat in some instances, the installation check also determines whetherthe test harness was also installed properly on UDPD 200.

Based on the results of the installation test performed (e.g., whetherimages of installed SCA components matches or does not match referenceinstallation data), a determination is made as to whether SCA 304installed properly, as represented by block 1115. If, for example, it isdetermined that SCA 304 did not install properly on UDPD 200 (e.g.,whether images of installed SCA components matches or does not matchreference installation data), the failure to install properly isreported and the SCA prevented from operating freely—e.g., disabling SCA304 so that it is unable to run on UDPD 200, as represented by block1120. For example, the installation failure may be logged and/orreported to the user. In some instances, test harness 310 may send areport of the failure to a remote device—e.g., via the internet. Again,in other instances, SCA 304 may be permitted to operate so that the usermay still use functions of SCA 304 that are not safety critical.

If, for example, it is determined at block 1115 that SCA 304 installedproperly on UDPD 200, a functional test is run to determine whether SCA304 is functioning properly on UDPD 200, as represented by block 1130.As described earlier, functional test may include one or more testroutines which may be executed—e.g., the computational test routines,timing test routines, display test routines, and/or communication testroutines.

At block 1135, a determination is made as to whether SCA 304 functionsproperly on UDPD 200. For example, functioning properly may require adetermination that SCA 304 is computing accurately on UDPD 200, that SCA304 is performing activities (e.g., computations) in a timely manner onUDPD 200, that data for SCA 304 is displayed properly on UDPD 200,and/or that SCA 304 may communicate properly (e.g., may establish afunction communication link and send/receive test data in a timelymanner) with an external device via a communication link between theexternal device and UDPD 200.

If, for example, it is determined that SCA 304 does not functionproperly on UDPD 200, then it is determined that SCA 304 is notoperating properly on UDPD 200 and SCA 304 may then be prevented fromoperating freely on UDPD 200, as represented by block 1140.

If, for example, SCA 304 functions properly, then it is determined thatSCA 304 is operating properly on UDPD 200 and an environment check isexecuted to determine and save the current environment of UDPD 200 thatis associated with the determination that SCA 304 is operating properly,as represented by block 1150. SCA 304 may then be allowed to operatefreely on UDPD 200. Furthermore, it should be appreciated that thechecks may be initiated in different orders in other implementations.

FIG. 12 illustrates a flow diagram for an exemplary process forperforming various checks, according to some aspects of the presentdisclosure. The flow diagram of FIG. 12 may, for example, occur atruntime after SCA 304 has already been permitted to operate freely(e.g., after the process described in FIG. 11 has been run). It shouldbe appreciated that the process may be run in the background on UDPD 200in some instances. For example, process 1200 may be run in thebackground while SCA 304 is being run, in the background when SCA 304 isnot being run, in the background while other applications are being runin the foreground, etc. Furthermore, it should be appreciated thatprocess 1200 may be transparent to the user.

At block 1205 of process 1200, an environment check is initiated todetermine if the ‘current environment’ of UDPD 200 has changed since thelast determination that SCA is operating properly and permitted tooperate freely on UDPD 200. Environment check may be initiated atvarious times—e.g., at predetermined times/intervals (e.g.,predetermined time intervals after SCA is permitted to operate freely onthe UDPD), and/or upon occurrences of certain events such as when SCA isrun, after SCA is closed, etc.

Environment check identifies the current environment—e.g., any currentlyinstalled software programs, applications, drivers, hardware components,etc. At block 1210, the current environment is then compared to apreviously stored ‘current environment’ that was associated with thelast determination that SCA 304 is operating properly on UDPD 200. Forexample, the comparison may determine if the current environment matchesor does not match the previously stored current environment. It shouldbe appreciated that not only newly installed programs may be accountedfor, but also removed programs and/or modifications to programs (e.g.,new revision updates, software fixes, firmware updates, etc.). In someembodiments, only the software environment may be taken intoconsideration. In other embodiments, the hardware environment may alsobe taken into consideration.

Based on the comparison in block 1210, a determination is made as towhether the environment of UDPD 200 has been changed since the lastdetermination that SCA 304 is operating properly on UDPD 200 andpermitted to operate freely on UDPD, as represented by block 1220.

If, for example, it is determined that the environment of UDPD 200 hasnot changed, then a certain level of confidence is achieved that SCA 304is still operating properly on UDPD 200. SCA 304 may, for example, bepermitted to continue operating freely, as represented by block 1245. Itis contemplated that in some instances, if the environment has notchanged, functional checks may still be initiated, in full or anabbreviated set, to provide greater assurance that SCA 304 is operatingproperly.

If, for example, it is determined that the environment of UDPD 200 haschanged, then SCA 304 may potentially operate improperly on UDPD 200 anda functional check is initiated, as represented by block 1225. Forexample, computational test routines, timing test routines, display testroutines, and/or communication test routines may be run to determine ifSCA 304 is functioning properly on UDPD 200. In some instances, SCA 304is permitted to continue to operate freely while the functional check isperformed. In some instances, SCA 304 is prevented from operating freelywhile the functional check is performed. In other implementations, aninstallation check may also be initiated if the environment has changed.

At block 1230, a determination is made as to whether SCA 304 functionsproperly on UDPD 200. For example, functioning properly may require adetermination that SCA 304 is computing accurately on UDPD 200, that SCA304 is performing activities (e.g., computations) in a timely manner onUDPD 200, that data for SCA 304 is displayed properly on UDPD 200,and/or that SCA 304 may communicate properly (e.g., may establish afunction communication link and communicate data accurately and in atimely manner) with an external device via a communication link betweenthe external device and UDPD 200.

If, for example, it is determined that SCA 304 does not functionproperly on UDPD 200, then it is determined that SCA 304 is notoperating properly on UDPD 200 and SCA 304 may then be prevented fromoperating freely on UDPD 200, as represented by block 1235. If, forexample, it is determined that SCA 304 functions properly, then thecurrent environment of UDPD 200 is saved, as represented by block 1240.SCA 304 is determined that SCA 304 is operating properly on UDPD 200 andSCA 304 is permitted to operate freely on UDPD 200, as represented byblock 1245. The process may be repeated again at another time and/oroccurrence of an event.

In some aspects of the present disclosure, UDPD 200 may include a hostintegrity check that is executed to determine if the integrity of SCA304 has been corrupted because a corrupted SCA 304 compromises anyassurance that SCA 304 operates properly on UDPD 200. In some instances,a determination that SCA 304 operates properly on UDPD 200 requires adetermination that SCA 304 is not corrupted. If SCA 304 is corrupted, itmay be determined that SCA 304 does not operate properly on UDPD 200 andSCA 304 may be prevented from operating freely on UDPD 200. If SCA 304is determined to be uncorrupted, it may be determined that SCA 304operates properly and permitted to operate freely, as long as any otherrequired checks performed, or to be performed, are successfully passedas well.

In some instances, the host integrity check is provided and maydetermine whether the codetext of SCA 304 is intact and uncorrupted.FIG. 13 illustrates a flow diagram for a host integrity check, accordingto some aspects of the present disclosure. At block 1305 of check 1300,a checksum for SCA 304 codetext is calculated. In addition to SCA 304codetext, the host integrity check may also check the integrity of othernonvolatile and critical data associated with SCA 304—e.g., data thatSCA 304 require or uses, such as reference data for various checks. Thecalculated checksum is then compared against a reference checksum, asrepresented by block 1310. The reference checksum is a checksum for SCA304 codetext (and/or additional data associated with SCA 304) in anuncorrupted state (e.g., a checksum calculated previously duringmanufacturing and testing and stored as a reference checksum for laterintegrity checks). In some instances, the reference checksum may bestored as part of reference data 408. At block 1315, it is determinedbased on the comparison whether SCA 304 codetext is corrupted. Forexample, if the calculated checksum matches the reference checksum, thenit is determined that SCA 304 is uncorrupted. On the other hand, if thecalculated checksum does not match the reference checksum, then it isdetermined that SCA 304 is corrupted. If the calculated checksum doesnot match the reference checksum, then SCA 304 is determined to becorrupted and SCA 304 is prevented from operating freely, as representedby block 1320. If SCA 304 is determined to be uncorrupted, then SCA 304is permitted to operate freely as long as any other required checksperformed, or to be performed, are successfully passed.

In some embodiments, the host integrity check may be implemented as atest module that resides on UDPD 200 in non-volatile memory. The hostintegrity test may be stored on UDPD 200 through any variety of methods.For example, the host integrity check may be provided to UDPD 200 viathe internet, from CD-ROM, memory stick, other external memory device,etc. In some instances, the host integrity check may be provided on aninstallation device (e.g., installation CD-ROM) that includes the testharness and/or SCA 304. In some instances, the host integrity check maybe included as part of the test harness and stored on UDPD 200 when thetest harness is loaded on UDPD 200.

The host integrity test may be programmed to initiate at various times.In some instances, the host integrity test may be initiated atnon-runtimes. For example, the host integrity check may be programmed toinitiate every time before SCA 304 is run, periodically after apredetermined amount of time, whenever the software environment haschanged, etc.

In some embodiments, the host integrity check may be initiated as partof an installation process. For example, in FIG. 11, in some instances,the host integrity check may be initiated before, after, orsimultaneously with functional check 1130 in process 1100. Therefore, inaddition to expected results for the installation check and functionalchecks, block 1155 would also require expected results for the hostintegrity check (e.g., that SCA 304 codetext is uncorrupted). If thehost integrity check results in unexpected results (e.g., SCA 304codetext is corrupted), then SCA 304 is prevented from operating freely.Thus, process 1100 would determine if SCA 304 installed correctly, ifthe integrity of SCA 304 maintained, and if SCA 304 functions properly.It should be understood that additional checks may also beincluded—e.g., the coexistence check, interoperability test, powermanagement test, etc.

In some embodiments, the host integrity check may be programmed toinitiate when the software environment has changed. For example, in FIG.12, in some instances, the host integrity check may be initiated before,after, or simultaneously with functional check 1225 in process 1200.Therefore, in addition to expected results for the functional check,block 1245 would also require expected results for the host integritycheck (e.g., that SCA 304 codetext is uncorrupted). If the hostintegrity check results in unexpected results (e.g., SCA 304 codetext iscorrupted), then SCA 304 is prevented from operating freely. Thus,process 1200 would determine if the environment changed, if theintegrity of SCA 304 is still maintained, and if SCA 304 still functionsproperly. It should be understood that additional checks may also beincluded—e.g., the coexistence check, interoperability test, powermanagement test, etc.

In some aspects of the present disclosure, a coexistence check may beinitiated to determine if SCA 304 is incompatible with other programs onUDPD 200 as relates to the safety critical nature of SCA 304. In someinstances, a determination that SCA 304 operates properly on UDPD 200requires at least a determination that SCA 304 is not incompatible withnon-related programs. If SCA 304 is incompatible with one or morenonrelated programs, then SCA 304 may be prevented from operating freelyon UDPD 200. If SCA 304 is not incompatible with any nonrelatedprograms, then it may be determined that SCA 304 operates properly andthus permitted to operate freely on UDPD 200, as long as any otherrequired checks performed, or to be performed, are successfully passedas well.

It should also be noted that various programs may be in different stateson UDPD 200—e.g., not running, in a passive state, in an active state,etc. To run a program, for example, UDPD 200 may load the program intovolatile memory (e.g., RAM) and then execute the program. In someinstances, when a program is invoked, the program is run on UDPD 200 inan active state. In other instances, a program may be brought uppartially but not actively running. The program may remain in thispassive state and wait for an invocation to bring the program into anactive state. For example, some programs need to be “alive” even thoughthey are not actively running—e.g., to update time, periodically monitordevices, to monitor for communications, etc. Safety criticalincompatibilities may exist between SCA 304 and non-related programswhen either, or both, of the programs are in either an active or passivestate.

The coexistence check identifies whether any safety criticalincompatibilities exist between SCA 304 and another application in theiractive and/or passive states. If an incompatibility exists, theappropriate action may be taken—e.g., SCA 304 may be prevented fromoperating freely on UDPD 200. In some instances, the user may be alertedto the incompatibility and requested not to use the incompatible programor to disable or uninstall the incompatible program.

FIG. 14 illustrates a flowchart for a coexistence check, according tosome aspects of the present disclosure. At block 1405 of check 1400, itis determined if any nonrelated programs share any resources with SCA304. If no resources are shared, then SCA 304 is not incompatible withany nonrelated programs, as represented by block 1430. If SCA 304 sharesresources with one or more nonrelated programs, then it is determined ifthe sharing of resources compromises the safety critical aspect of SCA304 by creating a conflict, as represented by block 1410. For example,the coexistence check may initiate a conflict scenario between SCA 304and the one or more non-related related programs, sequentially orsimultaneously. The conflict scenario may comprise, for example,bringing up SCA 304 and nonrelated application and having each attemptto access the shared resource at the same time. For instance, theconflict scenario may include a nonrelated application and SCA 304attempting to simultaneously use wireless communication, simultaneouslydisplay information to the display of UDPD 200, simultaneous read and/orwrite to memory, etc. As another example, the SCA may access a resourcefirst and subsequently thereafter, a nonrelated program attempt toaccess the same resource—or vice versa. Moreover, as another example, ifUDPD 200 is a mobile phone or smartphone, a conflict scenario may beinitiated to test how an incoming call received by UDPD 200 impacts SCA304 while performing various functions—e.g., a data transfer by SCA 304,a display of a test measurement by SCA 304, a sounding of an alarm bySCA 304, etc.

In some instances, the SCA 304 may share resources with other programswithout creating a conflict. For instance, the SCA 304 may have priorityaccess to resources in certain circumstances and thus take priority overother programs using the same resources. For example, SCA 304 may begiven priority access to communication ports on the UDPD 200—e.g., tocommunicate an alarm to another device via the communication port. SCA304 may, for example, have priority access to a wireless communicationdevice, to memory access, to processor access, and/or access to anyother shared resource that may be prioritized. It should be appreciatedthat priority access for the SCA 304 may also comprise priority accessfor communications to or for the SCA 304. For example, a medical device(e.g., analyte monitoring device, drug administration device, etc.) maysend a query from the medical device to the UDPD 200 (or vice versa)which, when operating properly, interrupts processes currently runningon the UDPD 200 in order to in order to create a transmission betweenthe two devices (e.g., verifying readiness to receive data, waiting fora response, communicating the data if the response is received andactivating an alarm if the response is not received). The coexistencecheck may initiate various conflict scenarios to test the sharing ofresources and determine if the SCA 304 is properly accessing theresources with priority over other programs trying to access the sameresource.

It should be understood that the each program may be brought up todifferent states (e.g., passive or active) to determine if any safetycritical issues are posed in any of the various combinations of states.Further, it should be understood that in some instances, a conflictscenario may include more than one nonrelated program and SCA 304accessing the same shared resource.

At block 1415, it is determined if SCA 304 and any nonrelated programsare incompatible. For example, if a nonrelated program is made to accessthe shared resource while SCA 304 is already accessing the resource,then it may be determined if the attempted access by the nonrelatedprogram sufficiently disrupts the access by SCA 304 to compromise thesafety critical nature of SCA 304. Or, for example, if SCA 304 is madeto access the shared resource while the nonrelated program is alreadyaccessing the resource, then it may be determined if SCA 304 can accessthe resource and whether it can do so sufficiently so as to notcompromise the safety critical nature of SCA 304. If SCA 304 cannotshare resources with the nonrelated program without compromising thesafety critical aspects of SCA 304, then SCA 304 and nonrelated programare determined to be incompatible and SCA 304 prevented from operatingfreely, as represented by block 1420. For example, if the conflictscenario prevents SCA 304 from performing any safety critical function,or significantly delays SCA 304 from performing the safety criticalfunction, then the nonrelated application and SCA 304 may be determinedto be incompatible. It should be appreciated that, in some instances,reference data to test incompatibility may be used for suchdeterminations.

SCA 304 may be prevented from operating freely, as described earlier forprevious checks (e.g., SCA disabled and prevented from running on UDPD200, SCA 304 permitted to operate but without the use of the safetycritical features or capabilities, etc.). In addition, in someinstances, SCA 304 may be permitted to operate without the use of theresource and/or feature that is in conflict with the nonrelated program.For example, if the shared resource in conflict is the Bluetoothreceiver, then SCA 304 may be permitted to operate without the functionof Bluetooth communication and/or features requiring the Bluetoothcommunication. In some instances, the user may be informed of the issueand/or prompted to address the issue—e.g., informed not to run theincompatible program, prompted to uninstall or disable the incompatiblenonrelated program before being permitted to use SCA 304, etc.

If SCA 304 can share resources with nonrelated programs withoutcompromising the safety critical aspects of SCA 304, then it isdetermined that SCA 304 is not incompatible with nonrelated programs, asrepresented by block 1425. SCA 304 may then be determined to operateproperly on UDPD 200 and permitted to operate freely on UDPD 200, aslong as any other required checks performed, or to be performed, aresuccessfully passed as well.

The coexistence test may be programmed to initiate at varioustimes—e.g., runtimes and/or non-runtimes. For example, the coexistencecheck may be programmed to initiate every time before SCA 304 is run,periodically after a predetermined amount of time, whenever the softwareenvironment has changed, etc.

In some embodiments, the coexistence check may be initiated as part ofan installation process. For example, in FIG. 11, a coexistence checkmay be initiated before, after, or simultaneously with functional check1130 in process 1100. Therefore, in addition to expected results for theinstallation check and functional check, block 1155 would also requireexpected results for the coexistence check (e.g., that SCA 304 is notincompatible with any nonrelated programs). If the coexistence checkresults in unexpected results (e.g., SCA 304 is incompatible with one ormore nonrelated programs), then SCA 304 may be prevented from operatingfreely. Thus, process 1100 would determine if SCA 304 installedcorrectly, if SCA 304 is compatible with the nonrelated programs on UDPD200, and if SCA 304 functions properly. It should be understood thatadditional checks may also be included—e.g., the host integrity check,interoperability test, power management test, etc.

In some embodiments, the coexistence check may be programmed to initiatewhen the software environment has changed. For example, in FIG. 12, thecoexistence check may be initiated before, after, or simultaneously withfunctional check 1225 in process 1200. Therefore, in addition toexpected results for the functional check, block 1245 would also requireexpected results for the coexistence check (e.g., that SCA 304 is notincompatible with other nonrelated programs). If the coexistence checkresults in unexpected results (e.g., SCA 304 is incompatible with anonrelated program), then SCA 304 may be prevented from operatingfreely. Thus, process 1200 would determine if the environment changed,if SCA 304 is compatible with the nonrelated programs on UDPD 200, andif SCA 304 still functions properly. It should be understood thatadditional checks may also be included—e.g., the host integrity check,interoperability test, power management test, etc.

In some embodiments, a determination that SCA 304 operates properly onthe UDPD requires a determination that SCA 304 interoperates properlywith related programs. If SCA 304 does not interoperate properly withother related programs, then it may be determined that SCA 304 does notoperate properly and SCA 304 may be prevented from operating freely onUDPD 200. If SCA 304 is determined to interoperate properly, then it maybe determined that SCA 304 operates properly on the UDPD and thuspermitted to operate freely, as long as any other required checksperformed, or to be performed, are successfully passed as well.

FIG. 15 illustrates a flowchart for an interoperability check, accordingto some aspects of the present disclosure. At block 1505 of check 1500,it is determined if any related programs work with SCA 304. If there areno related programs, then SCA 304 does not interoperate improperly withany related programs, as represented by block 1525. If related programsexist, then interoperability check tests the interoperations of therelated program and SCA 304, as represented by block 1510. It should beappreciated that more than one related program may be tested at one timein some instances.

For example, one or more related programs and SCA 304 are brought up andtested for proper interoperations. The testing may include, for example,verifying that SCA 304 and programs communicate using the propercommunication protocols, that data is being communicated back and forthaccurately and in a timely manner, that SCA 304 can properly access anyfeatures or capabilities associated with the related program, etc.

For example, SCA 304 may be an application related to analyte monitoringand provide some data measurement and data management capabilities whilean additional program may provide additional or more in-depth datamanagement capabilities. SCA 304 may provide for the logging ofmeasurements in memory on UDPD 200 and work in conjunction with anapplication that displays the logged measurements in different graphicalformats (e.g., graphs, charts, etc.), for instance. The interoperabilitytest may cross check, for example, values and times in the log with thecorresponding values in the graphical displays to determine if the datatransfers accurately.

As another example, SCA 304 may be an application related to analytemonitoring and interoperate with software programs for a remote sensordevice, analyte meter, pump provider (e.g., insulin pump device), etc.The testing may include, for example, verifying that SCA 304 and relatedprogram communicate using the proper communication protocols, that datais being communicated back and forth accurately and in a timely manner,that SCA 304 can properly access any features or capabilities associatedwith the related program, etc. Reference data may be used, for example,as inputs to simulate specific runtime events and to verify results ofthe simulated events (e.g., with specific reference data associated withthe simulated event).

While the interoperability check has been described separate from thefunctional check (e.g., communication test routine), it is nonethelesscontemplated that the interoperability check may work with, or beimplemented as part of the functionality test (e.g., communication testroutine) in some instances, to provide some assurance that SCA 304interoperates properly with external devices.

At block 1515, it is determined if SCA 304 and related programinteroperates properly. If it is determined that SCA 304 and relatedprogram do not interoperate properly, then SCA 304 is prevented fromoperating freely, as represented by block 1520. SCA 304 may be preventedfrom operating freely, as described earlier (e.g., SCA disabled andprevented from running on UDPD 200, SCA 304 permitted to operate butwithout the use of the safety critical features or capabilities, etc.).In addition, in some instances, SCA 304 may be permitted to operatewithout the use of the related program or its functionality (e.g., ifthe related program is not critical or required for SCA 304 to operate).For example, if the related program is a program providing additionaldata management capabilities as described in the example above, then SCA304 is permitted to operate but without the use of the related programor its functionality. In some instances, the user may be informed of theissue and/or prompted to address the issue—e.g., informed not to use therelated program or its functionality, prompted to uninstall or disablethe related program before being permitted to use SCA 304, etc.

If it is determined that SCA 304 and the related programs interoperateproperly, as represented by block 1525, then SCA 304 is determined tooperate properly on the UDPD and permitted to operate freely, as long asany other required checks performed, or required to be performed, aresuccessfully passed as well.

It should be understood that the each program may be brought up todifferent states (e.g., passive or active) to determine if anyinteroperability issues are posed in any of the various combinations ofstates. Further, it should be understood that in some instances morethan one related program may be tested with SCA 304 during theinteroperability test.

The interoperability check may be programmed to initiate at varioustimes—e.g., runtimes and/or non-runtimes. For example, theinteroperability check may be programmed to initiate every time beforeSCA 304 is run, periodically after a predetermined amount of time,whenever the software environment has changed, etc.

In some embodiments, the interoperability check may be initiated as partof the installation process. For example, in FIG. 11, theinteroperability check may be initiated before, after, or simultaneouslywith functional check 1130 in process 1100. Therefore, in addition toexpected results for the installation check and functional check, block1155 would also require expected results for the interoperability check(e.g., that SCA 304 interoperates properly with related programs). Ifthe interoperability check results in unexpected results (e.g., SCA 304does not interoperate properly with related programs), then SCA 304 isprevented from operating freely. Thus, process 1100 would determine ifSCA 304 installed correctly, if SCA 304 interoperates properly withrelated programs on UDPD 200, and if SCA 304 functions properly. Itshould be understood that additional checks may also be included—e.g.,the host integrity check, coexistence check, power management check,etc.

In some embodiments, the interoperability check may be programmed toinitiate when the software environment has changed. For example, in FIG.12, the interoperability check may be initiated before, after, orsimultaneously with functional check 1225 in process 1200. Therefore, inaddition to a expected results for the functional check, block 1245would also require expected results for the interoperability check(e.g., that SCA 304 interoperates properly with related programs). Ifthe interoperability check results in unexpected results (e.g., SCA 304does not interoperate properly with a related program), then SCA 304 isprevented from operating freely. Thus, process 1200 would determine ifthe environment changed, if SCA 304 interoperates properly with relatedprograms on UDPD 200, and if SCA 304 still functions properly. It shouldbe understood that additional checks may also be included—e.g., the hostintegrity check, coexistence check, power management check, etc.

In some embodiments, a power management check may be initiated todetermine if the power capabilities of UDPD 200 are sufficient to runSCA 304 safely with a certain level of assurance that the UDPD will notabruptly shutdown. For instances, the power capabilities may bedetermined from the remaining charge left on the battery, the currentreal-time power consumption rate (e.g., taking into account anyapplications running, features and capabilities activated, etc.), thetime remaining until shutdown or hibernation, etc. The remaining powerlife of UDPD 200 may be determined in days, hours, minutes, etc., untilneeding to be recharged. Moreover, if a power hungry feature of SCA 304is used (e.g., wireless capabilities, etc.), the remaining power life ofUDPD 200 may be reduced accordingly. The power capabilities may then becompared to a minimum threshold amount required to operate SCA 304safely with minimal risk of an abrupt shutdown.

FIG. 16 illustrates a flow diagram for a power management check,according to some aspects of the present disclosure. At block 1605 ofcheck 1600, the power capabilities of UDPD 200 are determined. Once thepower capability of UDPD 200 is determined, a comparison is made againstone or more minimum threshold amounts required to operate SCA 304 safelywith minimal risk of abrupt shutdown, as represented by block 1610.

In some instances, the minimum threshold amount required to operate SCA304 safely with minimal risk of abrupt shutdown may depend on apredetermined amount of time—e.g., determined during manufacturing andtesting and stored as reference data. For example, testing may determinethat SCA 304 requires a minimum threshold of time to operate and safelyperform safety critical functions. Or, as another example, testing maydetermine that SCA 304 requires a certain amount of current per day, perhour, etc., when actively running. It is also contemplated that thedifferent thresholds may exist for different features or functions(e.g., using the insulin calculator, communicating wirelessly with aninsulin pump, etc.).

In some instances, the minimum threshold amount required to operate SCA304 safely with minimal risk of abrupt shutdown may depend on historicalusage of SCA 304. A user's previous history of usage may be used todetermine an estimated minimum threshold requirement. For example, auser's previous usage may be tracked and used to determine an averageusage and amount of power consumed in a period of time (e.g., days,hours, minutes, etc.).

In some instances, the threshold power consumption required by SCA 304application may be estimated by tracking the usage history of the user.The usage history may account for specific events and the amount ofpower required for those events. For example, usage history may accountfor what features are accessed, how many times each feature is accessed,duration of use, etc. Example events for a SCA associated with analytemonitoring, such as glucose monitoring, may include, but are not limitedto, strip measurements, insulin delivery measurements, insulin delivery,continuous glucose measurement readings, calibrations, etc. Forinstance, it may be determined that a user's average usage includestaking ten daily strip measurements, calculating and administeringinsulin five times a day, five Bluetooth communications per day, etc. Acorresponding power consumption may then be determined. For example, itmay be determined that SCA 304 requires a certain amount of milliampsper day, per hour, per week, etc., when SCA 304 is actively running.This power consumption determination may then be compared against thepower capabilities determined for UDPD 200 to determine if UDPD 200 canmeet the power threshold required for SCA 304. For example, if SCA 304is used to receive CGM measurement readings derived from a sensor thatis inserted every 5 days, then it can be determined if UDPD 200 has thenecessary power capabilities to keep the CGM feature activated for theduration of time.

It is contemplated that in some instances various activities may betracked individually to determine how much power is consumed peractivity. In this way, a user's average usage can be tallied up peractivity to come to an average power consumption amount. In someinstances, a programmed therapy program can be implemented (e.g., by aphysician) and a minimum power consumption threshold tallied up based onthe customized program. It has been further contemplated that multipleuser profiles may be created and used—e.g., a profile for average dailyusage requirements, profiles for custom therapy programs, a profilespecific to periods of continuous glucose monitoring, etc. It shouldalso be understood that in some instances, the power consumption peractivity may be determined in manufacturing and testing—e.g., fordifferent types of UDPDs—and stored as reference data.

At block 1615, a determination whether UDPD 200 has sufficient powercapabilities to run SCA 304 safely with minimal risk of abrupt shutdownis made based on the comparison of the power capabilities of UDPD 200 toany minimum threshold amounts required. If the required thresholds arenot met, then SCA 304 is prevented from operating freely, represented byblock 1620. Again, this may include, for example, SCA 304 being disabledand prevented from running on UDPD 200, SCA 304 permitted to operate butwithout the use of the safety critical features or capabilities, etc.This may also include, in some instances, permitting SCA 304 to operatewithout the functions for which the thresholds are not met.

In some embodiments, a determination that SCA 304 operates properlyrequires at least that the UDPD have sufficient power capabilities tooperate safely with minimal risk of shutdown. If UDPD 200 has at leastthe minimum threshold of power capability, then at block 1625, UDPD 200is determined to have sufficient power capability. SCA 304 is determinedto operate properly on UDPD 200 and permitted to operate freely on UDPD200, as long as any other required checks performed, or required to beperformed, are successfully passed as well.

It is also contemplated that in some instances the power managementcheck may be initiated to determine if the power capabilities of UDPD200 are as expected. For example, average consumption rates fordifferent types of UDPDs running SCA 304 may be determined duringmanufacturing and testing and stored as reference data. Thereafter,during use by the user, the power management check may monitor the powerconsumption rates of UDPD 200 while running SCA 304. If the results varyfrom the reference data more than a predetermined threshold deviation,then the power management check indicates that SCA 304 is not operatingproperly on UDPD 200, and thus SCA 304 is prevented from operatingfreely. For example, it may be determined during manufacturing andtesting that the iPhone® can operate SCA 304 for 8 hours withoutrecharge. If the power management check is run after installed on auser's UDPD 200, and results in an estimated 2 hours without recharge,this may be indicative of issues on the device that may compromise thesafety critical features of the device. For instance, major deviationsin expected consumption rates may be indicative of software bugs orviruses. In such case, for example, SCA 304 may be prevented fromoperating freely and the user informed of, or prompted to address, theproblem (e.g., prompted to run a virus scan of the device).

The power management check may be programmed to initiate at varioustimes—e.g., runtimes and/or non-runtimes. For example, the powermanagement check may be programmed to initiate every time before SCA 304is run, periodically after a predetermined amount of time, whenever thesoftware environment has changed, etc.

In some embodiments, the power management check may be initiated as partof the installation process. For example, in FIG. 11, the powermanagement check may be initiated before, after, or simultaneously withfunctional check 1130 in process 1100. Therefore, in addition toexpected results for the installation check and functional check, block1155 would also require expected results for the power management check(e.g., that the UDPD has sufficient power capability to run the SCAsafely). If the power management check results in unexpected results(e.g., the UDPD does not have sufficient power capability to run the SCAsafely), then SCA 304 is prevented from operating freely. Thus, process1100 would determine if SCA 304 installed correctly, if UDPD 200 hassufficient power capability to run SCA 304 safely, and if SCA 304functions properly. It should be understood that additional checks mayalso be included—e.g., the host integrity check, coexistence check,interoperability check, etc.

In some embodiments, the power management check may be programmed toinitiate when the software environment has changed. For example, in FIG.12, the power management check may be initiated before, after, orsimultaneously with functional check 1225 in process 1200. Therefore, inaddition to a expected results for the functional check, block 1245would also require expected results for the power management check(e.g., that the UDPD has sufficient power capability to run the SCAsafely). If the power management check results in unexpected results(e.g., the UDPD does not have sufficient power capability to run SCA 304safely), then SCA 304 is prevented from operating freely. Thus, process1200 would determine if the environment changed, if the UDPD hassufficient power capability to run SCA 304 safely, and if SCA 304 stillfunctions properly. It should be understood that additional checks mayalso be included—e.g., the host integrity check, coexistence check,interoperability check, etc.

Throughout the foregoing description, for the purposes of explanation,numerous specific details were set forth in order to provide a thoroughunderstanding of the invention. It will be apparent, however, to oneskilled in the art that the invention may be practiced without some ofthese specific details. In addition, embodiments of the invention mayinclude various operations as set forth above, or fewer operations ormore operations, or operations in an order which is different from theorder described herein. Accordingly, the scope and spirit of theinvention should be judged in terms of the claims which follow as wellas the legal equivalents thereof.

It should be understood that techniques introduced in the preceding canbe implemented by programmable circuitry programmed or configured bysoftware and/or firmware, or they can be implemented entirely byspecial-purpose “hardwired” circuitry, or in a combination of suchforms. Such special-purpose circuitry (if any) can be in the form of,for example, one or more application-specific integrated circuits(ASICS), programmable logic devices (PLDs), field-programmable gatearrays (FPGAs), etc.

Software or firmware implementing the techniques introduced herein maybe stored on a machine-readable storage medium and may be executed byone or more general-purpose or special-purpose programmablemicroprocessors. A “machine-readable medium”, as the term is usedherein, includes any mechanism that can store information in a formaccessible by a machine (a machine may be, for example, a computer,network device, cellular phone, personal digital assistant (PDA),manufacturing took, any device with one or more processors, etc.). Forexample, a machine-readable medium can be used to store softwareinstructions, which when executed by a processor, causes the processorto perform the various methods of this description. A machine-readablemedium includes recordable/non-recordable media (e.g., read-only memory(ROM); random access memory (RAM); magnetic disk storage media; opticalstorage media; flash memory devices; etc.), or any type of mediasuitable for storing machine-readable instructions. The term “logic”, asused herein, can include, for example, special purpose hardwiredcircuitry, software and/or firmware in conjunction with programmablecircuitry, or a combination thereof.

The preceding merely illustrates the principles of the invention. Itwill be appreciated that those skilled in the art will be able to devisevarious arrangements which, although not explicitly described or shownherein, embody the principles of the invention and are included withinits spirit and scope. Furthermore, all examples and conditional languagerecited herein are principally intended to aid the reader inunderstanding the principles of the invention and the conceptscontributed by the inventors to furthering the art, and are to beconstrued as being without limitation to such specifically recitedexamples and conditions. Moreover, all statements herein recitingprinciples, aspects, and aspects of the invention as well as specificexamples thereof, are intended to encompass both structural andfunctional equivalents thereof. Additionally, it is intended that suchequivalents include both currently known equivalents and equivalentsdeveloped in the future, i.e., any elements developed that perform thesame function, regardless of structure. The scope of the presentinvention, therefore, is not intended to be limited to the exemplaryaspects shown and described herein. Rather, the scope and spirit ofpresent invention is embodied by the appended claims.

That which is claimed is:
 1. A method for executing instructions with anuncontrolled data processing device (UDPD) to determine whether a safetycritical application (SCA) is functioning properly on the UDPD bydetermining whether the codetext of the SCA is uncorrupted, the methodcomprising: executing instructions with UDPD to calculate, a hostintegrity check for a codetext of the SCA; retrieving a correspondingreference host integrity check calculation; comparing, with the UDPD,the calculated host integrity check and the retrieved correspondingreference host integrity check calculation; and determining, with theUDPD, whether a change exists in the calculated host integrity check andthe reference host integrity check.
 2. The method of claim 1, whereinthe reference host integrity check is a previously calculated storedhost integrity check.
 3. The method of claim 1, wherein the referencehost integrity check is a host integrity check for the SCA in anuncorrupted state.
 4. The method of claim 1, wherein the reference hostintegrity check is a host integrity check calculated previously duringmanufacturing and testing and stored in memory for later retrieval. 5.The method of claim 1, further comprising determining that the SCA isinstalled properly on the UDPD and permitting the SCA to operate freelyon the UDPD, if a match of the calculated host integrity check and thereference host integrity check is determined.
 6. The method of claim 1,further comprising determining that the SCA is not installed properly onthe UDPD, thereby preventing the SCA to operate freely on the UDPD, if amismatch of the calculated host integrity check and the reference hostintegrity check is determined.
 7. The method of claim 1, furthercomprising determining that the SCA is not installed properly on theUDPD, thereby disabling safety critical features of the SCA from beingexecuted on the UDPD and enabling non-safety critical features of theSCA to be executed on the UDPD, if a mismatch of the calculated hostintegrity check and the reference host integrity check is determined. 8.The method of claim 7, wherein the safety critical features of the SCAcomprises communication of the SCA with a remote device external to theUPDP.
 9. The method of claim 7, wherein the safety critical features ofthe SCA comprises determining an analyte concentration from a bodilyfluid executed on the UDPD.
 10. The method of claim 1, wherein the SCAis an analyte monitoring application.
 11. The method of claim 10,wherein the analyte is glucose or ketone.
 12. The method of claim 1,wherein the UDPD is a hand-help data processing device.
 13. The methodof claim 12, wherein the hand-help data processing device is a mobilephone.
 14. The method of claim 12, wherein the hand-help data processingdevice is a personal digital assistant (PDA).
 15. The method of claim 7,wherein the safety critical features of the SCA comprises receiving datafrom a sensor subcutaneously implanted in a subject.
 16. The method ofclaim 1, wherein the instructions are comprised in a test harnessapplication installed on the UDPD.